CVE-2015-0226 — Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

Description

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	wss4j	1.6.15-2	—
Debian 13	wss4j	1.6.15-2	—
Debian 12	wss4j	1.6.15-2	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 6	apache-commons-cli-eap6	1.2.0-1.redhat_8.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-codec-eap6	1.4.0-4.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-configuration-eap6	1.6.0-1.redhat_4.2.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-daemon-eap6	1:1.0.15-8.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-io-eap6	2.1.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-lang-eap6	2.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-pool-eap6	1.6.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-mime4j	0.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	atinject-eap6	1.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	avro-eap6	1.7.5-2.redhat_2.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	cal10n-eap6	0.7.7-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-10.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	eap6-apache-commons-cli	1.2.0-1.redhat_8.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-codec	1.4.0-4.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-configuration	1.6.0-1.redhat_4.2.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-avro	1.7.5-2.redhat_2.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-cal10n	0.7.7-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-ecj	4.4.2-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jandex	1.2.2-1.Final_redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jansi	1.9.0-1.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-joda-time	1.6.2-2.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-rngom	201103.0.0-1.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-snakeyaml	1.8.0-1.redhat_3.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	ecj-eap6	4.4.2-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jaf	1.1.1-17.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-javamail	1.4.5-2.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf-eap6	2.1.28-7.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf12-eap6	1.2.15-8.b01_redhat_12.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-beanvalidation-api	1.0.0-5.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-jpa-2.0-api +2	1.0.1-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate3-commons-annotations	4.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.18-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-search	4.6.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-validator	4.3.2-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq	2.3.25-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq-native +1	2.3.25-3.Final_redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	7.0.0-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcore-eap6 +1	4.3.3-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd +3	2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd22 +3	2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	httpmime-eap6 +2	4.3.6-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpserver	1.0.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	infinispan +4	5.2.11-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.31-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jansi-eap6	1.9.0-1.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	javassist-eap6	3.18.1-6.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-deployment	1.3.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-framework-core	2.1.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-metadata	2.2.0-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-repository	2.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-resolver	3.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-spi	3.2.0-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-vfs	1.2.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-aesh	0.33.14-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-as-ee +53	7.5.0-8.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-classfilewriter	1.0.3-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-beans	1.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-core	1:2.2.17-11.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-connector-api_1.6_spec +1	1.0.1-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-dmr +1	1.2.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-api_3.1_spec	1.0.2-11.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.30-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-genericjms	1.0.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-hal +1	2.5.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-iiop-client	1.0.0-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jad-api_1.2_spec +1	1.0.1-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxb-api_2.2_spec	1.0.4-4.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxr-api_1.0_spec	1.0.2-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrpc-api_1.1_spec	1.0.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrs-api_1.1_spec +1	1.0.1-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec +1	1.0.1-13.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logging	3.1.4-2.GA_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logmanager	1.5.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-metadata +5	7.2.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-modules	1.3.6-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-osgi-logging	1.0.0-7.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-rmi-api_1.0_spec	1.0.4-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-sasl	1.0.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-seam-int	6.0.0-10.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-servlet-api_3.0_spec	1.0.2-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-threads	2.1.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-vfs2	3.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-weld-1.1-api	1.1.0-1.Final_redhat_6.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-xnio-base	3.0.13-1.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-core	7.5.0-11.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-domain +5	7.5.0-9.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.0-23.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-modules-eap	7.5.0-14.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossts	1:4.17.29-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossweb	7.5.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossxb2	2.0.3-15.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jdom-eap6	1.1.3-1.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	joda-time-eap6	1.6.2-2.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jul-to-slf4j-stub	1.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	lucene-solr	3.6.2-5.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster +1	1.2.11-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster-native	1.2.11-2.Final_redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_jk +1	1.2.40-3.redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_rt	2.4.1-6.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_snmp	2.4.1-13.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl	1:2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl22	1:2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	objectweb-asm-eap6	3.3.1-8.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.core-eap6	4.2.0-14.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.enterprise-eap6	4.2.0-15.redhat_10.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox	4.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox-commons	1.0.0-1.final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketlink-bindings +1	2.5.4-5.SP4_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	relaxngDatatype-eap6	2011.1.0-1.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	resteasy	2.3.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	rngom-eap6	201103.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	snakeyaml-eap6	1.8.0-1.redhat_3.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	staxmapper	1.1.0-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-codemodel	2.6.0-1.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-txw2	20110809.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-ws-metadata-2.0-api	1.0.0-2.MR1_redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-xsom	20110809.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	tomcat-native +1	1.1.32-3.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	velocity-eap6	1.7.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	weld-cdi-1.0-api	1.0.0-1.SP4_redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2.0-1.redhat_10.2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.ws.security:wss4j	< 1.6.17	1.6.17	GHSA-vjwc-5hfh-2vv5
Maven	org.apache.wss4j:wss4j-ws-security-dom	>= 2.0.0, < 2.0.2	2.0.2	GHSA-vjwc-5hfh-2vv5

Advisories 3

RHSA-2015:0848 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0846 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0847 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

RHSA-2016:1376 vendor-advisory
RHSA-2015:0849 vendor-advisory
RHSA-2015:1176 vendor-advisory
RHSA-2015:1177 vendor-advisory
RHSA-2015:0848 vendor-advisory
RHSA-2015:0846 vendor-advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us
https://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc
RHSA-2015:0847 vendor-advisory
72553 vdb-entry
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html