Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-1279 EUVD-2022-24610GHSA-p496-gr7f-4c2g

Insecure EBICS messages encryption implementation in ebics-java/ebics-java-client could allow an adjacent attacker to decrypt EBICS payloads

Published Apr 14, 2022 · Updated Aug 2, 2024 · Assigned by NCSC.ch

Description

A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2.

Affected products

VendorProductAffectedFixed
ebics-java ebics-java-client unspecified – < 1.2 1.2

References