GitHub Advisoryadvisory · Maven

GHSA-jcp9-796g-pv9p Missing Cryptographic Step in OWASP Enterprise Security API for Java

LOW Published 2022-05-17 Modified 2024-03-20 Official page ↗
Aliases
CVE-2013-5679
Ecosystem
Maven
Packages
org.owasp.esapi:esapi
Severity
Low
Weaknesses
CWE-325
Reviewed
2022-07-07

Affected packages

• Maven org.owasp.esapi:esapi: >= 2.0.0, < 2.1.0 → fixed in 2.1.0

Description

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.

Related

Alias · CVE (1)

  • CVE-2013-5679 The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x… vulnerability

Weakness · CWE (1)

  • CWE-325 Missing Cryptographic Step weakness

References