Bug 1191451 (CVE-2015-0227) - CVE-2015-0227 wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property
Summary: CVE-2015-0227 wss4j: Apache WSS4J doesn't correctly enforce the requireSigned...
Status: CLOSED ERRATA
Alias: CVE-2015-0227
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150210,repor...
Keywords: Security
Depends On: 1191455 1196877 1196878 1196879 1196880 1196881 1196882 1196883 1196884 1196885 1196886 1196887 1196888 1196890 1196892 1196893 1196894 1196895 1196896 1196897 1207497 1207498 1207499
Blocks: 1191452 1206755 1212496 1232965 1258580 1258582
TreeView+ depends on / blocked
 
Reported: 2015-02-11 10:51 UTC by Vasyl Kaigorodov
Modified: 2019-06-08 20:25 UTC (History)
61 users (show)

(edit)
It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request.
Clone Of:
(edit)
Last Closed: 2016-07-12 21:26:07 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0773 normal SHIPPED_LIVE Important: Red Hat JBoss Data Grid 6.4.1 update 2015-04-01 18:48:20 UTC
Red Hat Product Errata RHSA-2015:0846 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update 2015-04-16 20:17:12 UTC
Red Hat Product Errata RHSA-2015:0847 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update 2015-04-16 20:13:53 UTC
Red Hat Product Errata RHSA-2015:0848 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update 2015-04-16 20:26:01 UTC
Red Hat Product Errata RHSA-2015:0849 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.0 update 2015-04-16 19:39:06 UTC
Red Hat Product Errata RHSA-2015:1176 normal SHIPPED_LIVE Important: Red Hat JBoss Fuse 6.2.0 update 2015-06-23 20:52:52 UTC
Red Hat Product Errata RHSA-2015:1177 normal SHIPPED_LIVE Important: Red Hat JBoss A-MQ 6.2.0 update 2015-06-23 20:52:10 UTC

Description Vasyl Kaigorodov 2015-02-11 10:51:30 UTC
Apache WSS4J has a "requireSignedEncryptedDataElements" boolean configuration property, which if set enforces that EncryptedData elements are in a signed subtree of the document. The default value of this property is "false". 
However, it is possible to circumvent this setting by various types of wrapping attacks.

This has been fixed in revision:

http://svn.apache.org/viewvc?view=revision&revision=1619359

Comment 1 Vasyl Kaigorodov 2015-02-11 10:57:28 UTC
Created wss4j tracking bugs for this issue:

Affects: fedora-all [bug 1191455]

Comment 6 errata-xmlrpc 2015-04-01 14:49:14 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Data Grid 6.4

Via RHSA-2015:0773 https://rhn.redhat.com/errata/RHSA-2015-0773.html

Comment 7 errata-xmlrpc 2015-04-16 15:39:45 UTC
This issue has been addressed in the following products:

  JBoss Enterprise Application Platform 6.4.0

Via RHSA-2015:0849 https://rhn.redhat.com/errata/RHSA-2015-0849.html

Comment 8 errata-xmlrpc 2015-04-16 16:30:08 UTC
This issue has been addressed in the following products:

  JBEAP 6.4.z for RHEL 6

Via RHSA-2015:0847 https://rhn.redhat.com/errata/RHSA-2015-0847.html

Comment 9 errata-xmlrpc 2015-04-16 16:32:33 UTC
This issue has been addressed in the following products:

  JBEAP 6.4.z for RHEL 5

Via RHSA-2015:0846 https://rhn.redhat.com/errata/RHSA-2015-0846.html

Comment 10 errata-xmlrpc 2015-04-16 16:35:07 UTC
This issue has been addressed in the following products:

  JBEAP 6.4.z for RHEL 7

Via RHSA-2015:0848 https://rhn.redhat.com/errata/RHSA-2015-0848.html

Comment 11 errata-xmlrpc 2015-06-23 16:52:37 UTC
This issue has been addressed in the following products:

  Red Hat JBoss A-MQ 6.2.0

Via RHSA-2015:1177 https://rhn.redhat.com/errata/RHSA-2015-1177.html

Comment 12 errata-xmlrpc 2015-06-23 16:53:37 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse 6.2.0

Via RHSA-2015:1176 https://rhn.redhat.com/errata/RHSA-2015-1176.html


Note You need to log in before you can comment on or make changes to this bug.