Lucene search

K
mageiaGentoo FoundationMGASA-2015-0064
HistoryFeb 11, 2015 - 11:47 p.m.

Updated owasp-esapi-java packages fix CVE-2013-5679

2015-02-1123:47:51
Gentoo Foundation
advisories.mageia.org
6

2.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

50.1%

Updated owasp-esapi-java packages fix security vulnerability: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length (CVE-2013-5679).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchowasp-esapi-java< 2.1.0-1owasp-esapi-java-2.1.0-1.mga4

2.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:H/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

50.1%