CVE-2015-0226

7.5HIGH

Key Information:

Vendor
Apache
Status
Wss4j
Vendor
CVE Published:
30 October 2017

Summary

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

References

https://access.redhat.com/errata/RHSA-2016:1376
vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0849.html
vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-1176.html
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.