CVE-2015-0227 Improper Access Control in Apache WSS4J
MediumCVSS 5.0
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ws.security/wss4j(Maven) | < 1.6.17 | 1.6.17 |
| org.apache.ws.security/wss4j(Maven) | = 1.5.10 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.11 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.12 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.2 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.3 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.4 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.5 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.6 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.7 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.8 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.5.9 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.0 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.1 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.10 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.11 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.12 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.13 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.14 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.15 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.16 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.2 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.3 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.4 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.5 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ws.security/wss4j(Maven) | = 1.6.6 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.7 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.8 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | = 1.6.9 | No fix listed |
| org.apache.ws.security/wss4j(Maven) | >= 2.0.0, < 2.02 | 2.02 |
| wss4j/wss4j(Maven) | < 1.6.17 | 1.6.17 |
| wss4j/wss4j(Maven) | = 1.5.0 | No fix listed |
| wss4j/wss4j(Maven) | = 1.5.1 | No fix listed |
| debian/wss4j(Debian:12) | < 1.6.15-2 | 1.6.15-2 |
| debian/wss4j(Debian:13) | < 1.6.15-2 | 1.6.15-2 |
| debian/wss4j(Debian:14) | < 1.6.15-2 | 1.6.15-2 |
| apache wss4j | <= 1.6.16 | No fix listed |
| apache wss4j | = 2.0.0 | No fix listed |
| apache wss4j | = 2.0.0-rc1 | No fix listed |
| apache wss4j | = 2.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- apache-wss4j-sec-bypass(100837) vdb-entry
- support.hpe.com
- www.oracle.com
- RHSA-2015:0773 vendor-advisory
- RHSA-2015:0846 vendor-advisory
- RHSA-2015:0847 vendor-advisory
- RHSA-2015:0848 vendor-advisory
- RHSA-2015:0849 vendor-advisory
- RHSA-2015:1176 vendor-advisory
- RHSA-2015:1177 vendor-advisory
- ws.apache.org patch vendor-advisory
- Debian Security Tracker CVE-2015-0227 vendor-advisory
- 72557 vdb-entry
- github.com
- bugs.debian.org issue-tracking