Description
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-4.redhat_00010.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.12-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.60.0-2.redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-codehaus-jackson +4 | 1.9.13-10.redhat_00007.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-cryptacular | 1.2.4-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.6.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-glassfish-el +1 | 3.0.1-5.b08_redhat_00004.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-glassfish-javamail | 1.6.2-2.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-10.SP3_redhat_00008.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.21-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.16-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-hibernate-commons-annotations | 5.0.5-1.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-hibernate-search +5 | 5.10.7-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-client | 4.5.4-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-httpcomponents-core | 4.4.5-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-infinispan +8 | 9.4.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.10.3-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jackson-databind | 2.9.10.2-2.redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jaegertracing-jaeger-client-java +2 | 0.34.3-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-1.redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.1.2-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jasypt | 1.9.3-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-javaee-security-soteria +1 | 1.0.0-3.redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jaxbintros | 1.0.3-1.GA_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-classfilewriter | 1.2.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-common-beans | 2.0.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-api_3.2_spec +1 | 1.0.2-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.31-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-invocation | 1.5.2-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.3_spec | 2.3.5-5.SP2_redhat_00003.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.8.9-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-openjdk-orb | 8.1.4-3.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.18-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting-jmx | 3.0.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-10.Final_redhat_00011.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration-eap7.3-server +6 | 1.7.1-5.Final_redhat_00006.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-threads | 2.3.3-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-vfs | 3.2.15-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jboss-websocket-api_1.1_spec | 1.1.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-3.1-api +2 | 3.1.0-6.SP2_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common | 3.2.3-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 4.0.20-2.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups-azure | 1.2.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-jgroups-kubernetes | 1.0.13-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-microprofile-config +1 | 1.4.0-1.redhat_00003.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-microprofile-health | 2.2.0-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-microprofile-metrics +1 | 2.3.0-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-microprofile-opentracing +1 | 1.3.3-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-microprofile-rest-client +1 | 1.4.0-1.redhat_00004.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.1-1.Final_redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.8-1.Final_redhat_00002.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-opensaml +13 | 3.3.1-1.redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-7.Final_redhat_00006.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-picketlink-bindings +1 | 2.5.5-23.SP12_redhat_00012.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-9.SP8_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-slf4j-jboss-logmanager | 1.0.4-1.GA_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-smallrye-config | 1.3.6-1.SP01_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-smallrye-health | 1.0.2-2.redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-smallrye-metrics | 2.4.0-1.redhat_00004.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-smallrye-opentracing | 1.3.4-1.redhat_00004.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.24.0-2.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-stax2-api | 4.2.0-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-sun-istack-commons +2 | 3.0.10-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-txw2 +8 | 2.3.3-4.b02_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.30-2.SP2_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-weld-cdi-2.0-api | 2.0.0-4.SP1_redhat_00004.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.4-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.8-3.GA_redhat_00002.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.10.6-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.20-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.8-3.GA_redhat_00002.1.el7eap | RHSA-2020:2512, RHSA-2020:2059 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.12-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.10-1.Final_redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-woodstox-core | 6.0.3-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
| Red Hat JBoss EAP 7 | eap7-ws-commons-XmlSchema | 2.2.4-1.redhat_00001.1.el6eap | RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.2.5-1.redhat_00001.1.el6eap | RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.cryptacular:cryptacular | < 1.1.4 | 1.1.4 | GHSA-x64g-4xx9-fh6x |
| Maven | org.cryptacular:cryptacular | >= 1.2.0, < 1.2.4 | 1.2.4 | GHSA-x64g-4xx9-fh6x |
Advisories 10
- RHSA-2020:2512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:2513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:2511 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2025-2123 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2020:2059 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2060 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2058 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 18, 2024
References
- [ws-dev] 20200219 [jira] [Created] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
- [ws-commits] 20200219 [ws-wss4j] branch 2_2_x-fixes updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
- [ws-dev] 20200219 [jira] [Resolved] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
- [ws-commits] 20200219 [ws-wss4j] branch master updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
- [ws-dev] 20200318 [jira] [Closed] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
- [tomee-commits] 20201013 [jira] [Created] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
- [tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
- [tomee-commits] 20210426 [jira] [Commented] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
- [tomee-commits] 20210426 [jira] [Updated] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
- [tomee-commits] 20210426 [jira] [Comment Edited] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153
- https://github.com/vt-middleware/cryptacular/issues/52
- https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/apereo/cas/pull/4685
- https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45
- https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75
- https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f