CVE-2011-2487: Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
Summary
CVE-2011-2487: Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J. Affects org.apache.ws.security:wss4j versions < 1.6.5. Fixed in 1.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting parts of the message, and verifying signatures and decryption. The library is commonly used in Java-based web services and applications that require secure communication. However, versions prior to 1.6.5 are susceptible to a vulnerability known as a Bleichenbacher attack.
Vulnerability Detail
The vulnerability in Apache WSS4J arises from the use of the PKCS#1 v1.5 key transport mechanism for XMLEncryption. This mechanism is vulnerable to a Bleichenbacher attack, which allows an attacker to decrypt encrypted data or forge signatures. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive information or tamper with the integrity of the encrypted data. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
How To Fix
Minimum fixed version
1.6.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache WSS4J, identified as CVE-2011-2487, exposes the PKCS#1 v1.5 key transport mechanism to a Bleichenbacher attack. This vulnerability can be mitigated by upgrading to Apache WSS4J version 1.6.5 or later. Developers should promptly update their projects to ensure the security of their web services and applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ws.security:wss4j →
FAQ
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting parts of the message, and verifying signatures and decryption.
A Bleichenbacher attack is a cryptographic attack that targets vulnerabilities in the PKCS#1 v1.5 key transport mechanism. It allows an attacker to decrypt encrypted data or forge signatures by exploiting weaknesses in the padding scheme.
The vulnerability in Apache WSS4J could allow an attacker to gain unauthorized access to sensitive information or tamper with the integrity of encrypted data. This could lead to data breaches, unauthorized data modifications, or other security incidents.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
To fix this vulnerability, you should upgrade Apache WSS4J to version 1.6.5 or later. Update the dependency declaration in your project's pom.xml file to use the fixed version, and rebuild the project.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ws.security:wss4j.
