CVE-2015-0227: Improper Access Control in Apache WSS4J
Summary
CVE-2015-0227: Improper Access Control in Apache WSS4J. Affects org.apache.ws.security:wss4j across 2 version ranges.
< 1.6.17
>= 2.0.0, < 2.02
Fixed in 1.6.17 or 2.02, depending on the release line you run. How to fix ↓
Also tracked for
- wss4j · Debian:11
The same CVE-2015-0227 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting message parts, and verifying signatures and decryption. WSS4J is widely used in Java-based web services and applications to ensure the security of communication. However, a vulnerability has been discovered in versions before 1.6.17 and 2.x before 2.0.2 that allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via vectors related to 'wrapping attacks.' This vulnerability, identified as CVE-2015-0227, poses a moderate risk to applications utilizing WSS4J.
Vulnerability Detail
The vulnerability in Apache WSS4J allows attackers to bypass the requireSignedEncryptedDataElements configuration. This can be exploited through 'wrapping attacks,' where an attacker manipulates the SOAP message structure to evade the expected security checks. By bypassing the requireSignedEncryptedDataElements configuration, an attacker may be able to send unsigned or unencrypted data elements, potentially compromising the integrity and confidentiality of the communication. This vulnerability has been assigned a moderate severity rating (CWE-284).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.6.171.6.17 -
>= 2.0.0, < 2.022.02
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed version of Apache WSS4J as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache WSS4J can be mitigated by upgrading to the fixed version of the library. It is crucial to promptly address this vulnerability to ensure the security of SOAP message communication. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ws.security:wss4j →
FAQ
Apache WSS4J is a Java library for implementing the OASIS Web Services Security (WS-Security) standard. It provides functions for securing SOAP messages by adding digital signatures, encrypting message parts, and verifying signatures and decryption.
This vulnerability allows remote attackers to bypass the requireSignedEncryptedDataElements configuration in Apache WSS4J. By exploiting this vulnerability, an attacker may be able to send unsigned or unencrypted data elements, potentially compromising the integrity and confidentiality of the communication.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Apache WSS4J. For versions before 1.6.17, upgrade to 1.6.17 or later. For versions 2.x before 2.0.2, upgrade to 2.0.2 or later. Update the WSS4J dependency in your project's Maven pom.xml file to the fixed version and perform a clean build and thorough testing.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed version of Apache WSS4J.
You can find more information about this vulnerability in the CVE-2015-0227 advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ws.security:wss4j.
