CVE-2015-0227: Medium severity apache wss4j vulnerability
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Other sources
Apache WSS4J has a "requireSignedEncryptedDataElements" boolean configuration property, which if set enforces that EncryptedData elements are in a signed subtree of the document. The default value of this property is "false". However, it is possible to circumvent this setting by various types of wrapping attacks.
This has been fixed in revision:
http://svn.apache.org/viewvc?view=revision&revision=1619359
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0227?
CVE-2015-0227 has a medium severity rating as it allows remote attackers to bypass security configurations.
How do I fix CVE-2015-0227?
To fix CVE-2015-0227, upgrade Apache WSS4J to version 1.6.17 or 2.0.2 or later.
Which versions of Apache WSS4J are affected by CVE-2015-0227?
CVE-2015-0227 affects Apache WSS4J versions prior to 1.6.17 and all 2.x versions before 2.0.2.
What is the impact of CVE-2015-0227?
The impact of CVE-2015-0227 is the potential unauthorized access due to the bypass of signed encrypted data elements.
Is there a workaround for CVE-2015-0227 if I can't upgrade?
There is no known workaround for CVE-2015-0227, thus upgrading is essential to mitigate the risk.