CVE-2015-0226 in PeopleSoft Enterprise PeopleTools

Resumen (Inglés)

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Reservar

2014-11-18

Divulgación

2017-10-30

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
138103	Oracle PeopleSoft Enterprise PeopleTools Apache WSS4J cifrado débil	327	No está definido	Arreglo oficial	CVE-2015-0226
108794	Apache WSS4J Incomplete Fix Leak cifrado débil	327	No está definido	Arreglo oficial	CVE-2015-0226

Fuentes

• MITRE
• NVD
• CVE Details