GHSA-4qqf-hmv6-r6whMediumCVSS 5.9

Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

Published
April 22, 2022
Last Modified
April 16, 2026

🔗 CVE IDs covered (1)

CVE-2011-2487 →

📋 Description

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

🎯 Affected products2

  • maven/org.apache.ws.security:wss4j:< 1.6.5
  • maven/wss4j:wss4j:< 1.6.5

🔗 References (37)