CVE-2015-0227 — Improper Access Control in Apache WSS4J

Description

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	wss4j	1.6.15-2	—
Debian 13	wss4j	1.6.15-2	—
Debian 12	wss4j	1.6.15-2	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss EAP 6	apache-commons-cli-eap6	1.2.0-1.redhat_8.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-codec-eap6	1.4.0-4.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-configuration-eap6	1.6.0-1.redhat_4.2.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-daemon-eap6	1:1.0.15-8.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-io-eap6	2.1.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-lang-eap6	2.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-commons-pool-eap6	1.6.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	apache-mime4j	0.6.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	atinject-eap6	1.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	avro-eap6	1.7.5-2.redhat_2.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	cal10n-eap6	0.7.7-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-10.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	eap6-apache-commons-cli	1.2.0-1.redhat_8.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-codec	1.4.0-4.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-apache-commons-configuration	1.6.0-1.redhat_4.2.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-avro	1.7.5-2.redhat_2.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-cal10n	0.7.7-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-ecj	4.4.2-1.redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jandex	1.2.2-1.Final_redhat_1.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-jansi	1.9.0-1.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-joda-time	1.6.2-2.redhat_5.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-rngom	201103.0.0-1.redhat_4.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	eap6-snakeyaml	1.8.0-1.redhat_3.1.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	ecj-eap6	4.4.2-1.redhat_1.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jaf	1.1.1-17.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-javamail	1.4.5-2.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf-eap6	2.1.28-7.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	glassfish-jsf12-eap6	1.2.15-8.b01_redhat_12.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-beanvalidation-api	1.0.0-5.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate-jpa-2.0-api +2	1.0.1-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate3-commons-annotations	4.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.18-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-search	4.6.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hibernate4-validator	4.3.2-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq	2.3.25-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	hornetq-native +1	2.3.25-3.Final_redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	7.0.0-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpcore-eap6 +1	4.3.3-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd +3	2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpd22 +3	2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	httpmime-eap6 +2	4.3.6-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	httpserver	1.0.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	infinispan +4	5.2.11-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.31-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jansi-eap6	1.9.0-1.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	javassist-eap6	3.18.1-6.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-deployment	1.3.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-framework-core	2.1.0-5.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-metadata	2.2.0-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-repository	2.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-resolver	3.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-spi	3.2.0-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbosgi-vfs	1.2.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-aesh	0.33.14-1.redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-as-ee +53	7.5.0-8.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-classfilewriter	1.0.3-3.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-beans	1.1.0-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-common-core	1:2.2.17-11.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-connector-api_1.6_spec +1	1.0.1-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-dmr +1	1.2.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-api_3.1_spec	1.0.2-11.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-ejb-client	1.0.30-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-genericjms	1.0.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-hal +1	2.5.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-iiop-client	1.0.0-5.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jad-api_1.2_spec +1	1.0.1-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxb-api_2.2_spec	1.0.4-4.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxr-api_1.0_spec	1.0.2-6.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrpc-api_1.1_spec	1.0.1-5.Final_redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jaxrs-api_1.1_spec +1	1.0.1-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec +1	1.0.1-13.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-jsp-api_2.2_spec	1.0.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logging	3.1.4-2.GA_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-logmanager	1.5.4-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-metadata +5	7.2.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-modules	1.3.6-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-osgi-logging	1.0.0-7.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-remote-naming	1.0.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-rmi-api_1.0_spec	1.0.4-10.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-sasl	1.0.5-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-seam-int	6.0.0-10.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-servlet-api_3.0_spec	1.0.2-4.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-threads	2.1.2-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-vfs2	3.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-weld-1.1-api	1.1.0-1.Final_redhat_6.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jboss-xnio-base	3.0.13-1.GA_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-core	7.5.0-11.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-domain +5	7.5.0-9.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-javadocs	7.5.0-23.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossas-modules-eap	7.5.0-14.Final_redhat_21.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossts	1:4.17.29-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossweb	7.5.7-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jbossxb2	2.0.3-15.GA_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jcip-annotations-eap6	1.0.0-1.redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jdom-eap6	1.1.3-1.redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	joda-time-eap6	1.6.2-2.redhat_5.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	jul-to-slf4j-stub	1.0.1-2.Final_redhat_2.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	log4j-jboss-logmanager	1.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	lucene-solr	3.6.2-5.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster +1	1.2.11-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_cluster-native	1.2.11-2.Final_redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_jk +1	1.2.40-3.redhat_2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_rt	2.4.1-6.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_snmp	2.4.1-13.GA.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl	1:2.2.26-38.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	mod_ssl22	1:2.2.26-38.ep6.el7	RHSA-2015:0848
Red Hat JBoss EAP 6	objectweb-asm-eap6	3.3.1-8.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.core-eap6	4.2.0-14.redhat_8.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	org.osgi.enterprise-eap6	4.2.0-15.redhat_10.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox	4.1.1-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketbox-commons	1.0.0-1.final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	picketlink-bindings +1	2.5.4-5.SP4_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	relaxngDatatype-eap6	2011.1.0-1.redhat_9.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	resteasy	2.3.10-1.Final_redhat_1.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	rngom-eap6	201103.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	snakeyaml-eap6	1.8.0-1.redhat_3.1.ep6.el5	RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	staxmapper	1.1.0-7.Final_redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-codemodel	2.6.0-1.redhat_3.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-txw2	20110809.0.0-1.redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-ws-metadata-2.0-api	1.0.0-2.MR1_redhat_7.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	sun-xsom	20110809.0.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	tomcat-native +1	1.1.32-3.redhat_1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	velocity-eap6	1.7.0-1.redhat_4.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	weld-cdi-1.0-api	1.0.0-1.SP4_redhat_5.1.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2.0-1.redhat_10.2.ep6.el5	RHSA-2015:0848, RHSA-2015:0847, RHSA-2015:0846

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.ws.security:wss4j	< 1.6.17	1.6.17	GHSA-6r5v-hp32-fjqw
Maven	org.apache.ws.security:wss4j	>= 2.0.0, < 2.02	2.02	GHSA-6r5v-hp32-fjqw
Maven	wss4j:wss4j	< 1.6.17	1.6.17	GHSA-6r5v-hp32-fjqw

Advisories 4

RHSA-2015:0848 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0846 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0847 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025

References

RHSA-2015:0773 vendor-advisory
apache-wss4j-sec-bypass(100837) vdb-entry
RHSA-2015:0849 vendor-advisory
RHSA-2015:1176 vendor-advisory
RHSA-2015:1177 vendor-advisory
RHSA-2015:0848 vendor-advisory
RHSA-2015:0846 vendor-advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us
http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.asc
72557 vdb-entry
RHSA-2015:0847 vendor-advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html