ALT-PU-2016-3286: package wss4j update to version 1.6.18-alt1_3jpp8
Описание
This update upgrades wss4j to version 1.6.18-alt1_3jpp8.
Устраненные уязвимости4
Ссылки4
GHSA-6r5v-hp32-fjqw
https://github.com/advisories/GHSA-6r5v-hp32-fjqwGHSA-99v3-9x35-c5vf
https://github.com/advisories/GHSA-99v3-9x35-c5vfGHSA-vjwc-5hfh-2vv5
https://github.com/advisories/GHSA-vjwc-5hfh-2vv5Связанные уязвимости
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Уязвимость программного средства Apache WSS4J, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."