GitHub Advisoryadvisory · Maven

GHSA-x64g-4xx9-fh6x Denial of Service in Cryptacular

HIGH Published 2020-06-10 Modified 2021-10-21 Official page ↗
Aliases
CVE-2020-7226
Ecosystem
Maven
Packages
org.cryptacular:cryptacular
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2020-06-10

Affected packages

• Maven org.cryptacular:cryptacular: < 1.1.4 → fixed in 1.1.4 • Maven org.cryptacular:cryptacular: >= 1.2.0, < 1.2.4 → fixed in 1.2.4

Description

CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with &quot;new byte&quot; may depend on untrusted input within the header of encoded data.

Related

Alias · CVE (1)

  • CVE-2020-7226 CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References