Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 10 Feb 2015 11:41:37 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: users@...apache.org, "dev@...apache.org" <dev@...apache.org>, 
	Apache Security Response Team <security@...che.org>, oss-security@...ts.openwall.com, 
	bugtraq@...urityfocus.com
Cc: Juraj Somorovsky <juraj.somorovsky@....de>
Subject: Two new security advisories released for Apache WSS4J

Two new security advisories have been released for Apache WSS4J:

1) CVE-2015-0226: Apache WSS4J is (still) vulnerable to Bleichenbacher's
attack

http://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc

2) CVE-2015-0227: Apache WSS4J doesn't correctly enforce the
requireSignedEncryptedDataElements property

http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.asc

Please note that both of these advisories were fixed in WSS4J 2.0.2 and
1.6.17, both of which were released last year.

Colm.


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ