CVE-2020-7226: Denial of Service in Cryptacular
Summary
CVE-2020-7226: Denial of Service in Cryptacular. Affects org.cryptacular:cryptacular across 2 version ranges.
< 1.1.4
>= 1.2.0, < 1.2.4
Fixed in 1.1.4 or 1.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cryptacular is a Java library that provides a set of cryptographic utilities. It is commonly used in various applications, including Apereo CAS. This vulnerability affects versions of Cryptacular prior to 1.2.4. The vulnerability allows attackers to trigger excessive memory allocation during a decode operation, potentially leading to a denial of service (DoS) attack. The issue arises from the length of the nonce array associated with 'new byte' being influenced by untrusted input within the header of encoded data.
Vulnerability Detail
The vulnerability in Cryptacular can be exploited by an attacker to cause a DoS condition. By manipulating the header of encoded data, an attacker can trigger excessive memory allocation, potentially exhausting system resources and rendering the application unresponsive. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to note that this vulnerability only affects versions of Cryptacular prior to 1.2.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.41.1.4 -
>= 1.2.0, < 1.2.41.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update Cryptacular to the fixed version to mitigate the risk.
Conclusion
The vulnerability in Cryptacular prior to version 1.2.4 can lead to a denial of service (DoS) condition. To mitigate the risk, it is crucial to update Cryptacular to version 1.2.4 or later. Failure to do so may result in potential system resource exhaustion and unresponsiveness of the affected application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.cryptacular:cryptacular →
FAQ
This vulnerability can lead to a denial of service (DoS) condition, potentially causing the affected application to become unresponsive.
Versions of Cryptacular prior to 1.2.4 are affected by this vulnerability.
There are no known exploits for this vulnerability at the time of this report.
Yes, updating Cryptacular to version 1.2.4 or later will fix this vulnerability.
No, updating to the fixed version is the only known mitigation for this vulnerability.
