You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@ws.apache.org by Colm O hEigeartaigh <co...@apache.org> on 2015/02/10 12:41:37 UTC

Two new security advisories released for Apache WSS4J

Two new security advisories have been released for Apache WSS4J:

1) CVE-2015-0226: Apache WSS4J is (still) vulnerable to Bleichenbacher's
attack

http://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc

2) CVE-2015-0227: Apache WSS4J doesn't correctly enforce the
requireSignedEncryptedDataElements property

http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.asc

Please note that both of these advisories were fixed in WSS4J 2.0.2 and
1.6.17, both of which were released last year.

Colm.


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com