Org.apache.ws.security:wss4j

This hub aggregates every CVE we track for Org.apache.ws.security:wss4j, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 4 most recently published vulnerabilities affecting Org.apache.ws.security:wss4j.

• CVE-2011-2487The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.5.9Mar 11, 2020
• CVE-2015-0226Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers...7.5Oct 30, 2017
• CVE-2015-0227Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."5.0Feb 12, 2015
• CVE-2014-3623Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmatio...5.0Oct 30, 2014