GHSA-VJWC-5HFH-2VV5 Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

🗓️ 14 May 2022 00:55:57Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Apache Web Services Security before 1.6.17 and 2.0.x before 2.0.2 leaks decryption failure information, aiding plaintext key recovery.

Reporter	Title	Published	Views	Family All 51
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (CVE-2015-0226)	26 Sep 202203:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WSS4J affects IBM Cúram (CVE-2015-0226 & CVE-2015-0227 )	17 Jun 201813:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source Apache WSS4J affect IBM InfoSphere DataStage Web services pack (CVE-2015-0226 CVE-2015-0227)	16 Jun 201814:07	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
IBM Security Bulletins	Security Bulletin: Apache WSS4J Vulnerabilities Affect IBM Sterling B2B Integrator	13 May 202214:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.6	15 Jun 201807:03	–	ibm
Tenable Nessus	IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	IBM WebSphere Application Server 8.0 < 8.0.0.11 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0846)	20 Apr 201500:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2015-0226
github	www.github.com/apache/ws-wss4j/commit/970b3e3756e2c75bf2379ce198365e1a7168c3c3
github	www.github.com/apache/ws-wss4j/commit/de5104b30ddde5fe7388ad57e1c5ace5c5509924
access	www.access.redhat.com/errata/RHSA-2016:1376
github	www.github.com/apache/ws-wss4j
support	www.support.hpe.com/hpsc/doc/public/display
svn	www.svn.apache.org/viewvc
ws	www.ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc
oracle	www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
rhn	www.rhn.redhat.com/errata/RHSA-2015-0846.html

19 Feb 2025 21:31Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.05501