oss-sec mailing list archives
Two new security advisories released for Apache WSS4J
From: Colm O hEigeartaigh <coheigea () apache org>
Date: Tue, 10 Feb 2015 11:41:37 +0000
Two new security advisories have been released for Apache WSS4J: 1) CVE-2015-0226: Apache WSS4J is (still) vulnerable to Bleichenbacher's attack http://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc 2) CVE-2015-0227: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.asc Please note that both of these advisories were fixed in WSS4J 2.0.2 and 1.6.17, both of which were released last year. Colm. -- Colm O hEigeartaigh Talend Community Coder http://coders.talend.com
Current thread:
- Two new security advisories released for Apache WSS4J Colm O hEigeartaigh (Feb 10)