wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)

🗓️ 16 Apr 2015 16:17:12Reported by RedHatType

redhat🔗 access.redhat.com👁 5 Views

Apache WSS4J remains vulnerable to Bleichenbacher attack due to incomplete fix, exposing plaintext keys.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Integrated Information Core (CVE-2015-0226)	26 Sep 202203:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WSS4J affects IBM Cúram (CVE-2015-0226 & CVE-2015-0227 )	17 Jun 201813:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Open Source Apache WSS4J affect IBM InfoSphere DataStage Web services pack (CVE-2015-0226 CVE-2015-0227)	16 Jun 201814:07	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
IBM Security Bulletins	Security Bulletin: Apache WSS4J Vulnerabilities Affect IBM Sterling B2B Integrator	13 May 202214:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.6	15 Jun 201807:03	–	ibm
Tenable Nessus	IBM WebSphere Application Server 7.0 < 7.0.0.39 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	IBM WebSphere Application Server 8.0 < 8.0.0.11 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	IBM WebSphere Application Server 8.5 < 8.5.5.6 Multiple Vulnerabilities (FREAK)	26 Oct 201600:00	–	nessus
Tenable Nessus	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.0 update (Important) (RHSA-2015:0846)	20 Apr 201500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	5	noarch	apache-commons-cli-eap6	1.2.0-1.redhat_8.1.ep6.el5	apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-codec-eap6	1.4.0-4.redhat_4.1.ep6.el5	apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-configuration-eap6	1.6.0-1.redhat_4.2.ep6.el5	apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-daemon-eap6	1:1.0.15-8.redhat_1.ep6.el5	apache-commons-daemon-eap6-1:1.0.15-8.redhat_1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-io-eap6	2.1.0-1.redhat_4.1.ep6.el5	apache-commons-io-eap6-2.1.0-1.redhat_4.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-lang-eap6	2.6.0-1.redhat_4.1.ep6.el5	apache-commons-lang-eap6-2.6.0-1.redhat_4.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-commons-pool-eap6	1.6.0-1.redhat_7.1.ep6.el5	apache-commons-pool-eap6-1.6.0-1.redhat_7.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	apache-mime4j	0.6.0-1.redhat_4.1.ep6.el5	apache-mime4j-0.6.0-1.redhat_4.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	atinject-eap6	1.0.0-1.redhat_5.1.ep6.el5	atinject-eap6-1.0.0-1.redhat_5.1.ep6.el5.noarch.rpm
Red Hat Enterprise Linux	5	noarch	avro-eap6	1.7.5-2.redhat_2.1.ep6.el5	avro-eap6-1.7.5-2.redhat_2.1.ep6.el5.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2015-0226
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2015-0226
cve	www.cve.org/CVERecord

04 Aug 2026 21:59Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25

CVSS 37.5

EPSS0.05501

Bleichenbacher attack XML Encryption incomplete fix plaintext keys remote attacker apache wss4j