Information Disclosure Vulnerability in Apache WSS4J

CVE-2015-0226

Summary

Certain versions of Apache WSS4J contain a vulnerability that allows remote attackers to gain access to sensitive information related to decryption failures. This occurs when the library handles encrypted messages, potentially allowing an attacker to reconstruct the plaintext symmetric key through a series of carefully crafted messages. This exposure arises from an incomplete fix addressing previous vulnerabilities, underscoring the importance of prompt updates and vigilant security practices.

References