CVE-2020-7226 - 漏洞详情

CVE-2020-7226 (CNNVD-202001-1087)

HIGH

中文标题:

Cryptacular 跨站脚本漏洞

英文标题:

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attacke...

CVSS分数: 7.5

发布时间: 2020-01-24 14:17:16

漏洞类型: 跨站脚本

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Cryptacular是开源的用于 Java的Bouncy Castle Crypto API的补充。 cryptacular 存在跨站脚本漏洞，该漏洞源于在CiphertextHeader.java中解码操作期间过多的内存分配。

英文描述:

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

CWE类型:

CWE-770

受影响产品

厂商	产品	版本	版本范围	平台	CPE
vt	cryptacular	*	-	-	`cpe:2.3:a:vt:cryptacular::::::::`
oracle	communications_services_gatekeeper	7.0	-	-	`cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:::::::*`
oracle	webcenter_sites	12.2.1.3.0	-	-	`cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:::::::*`
oracle	webcenter_sites	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:::::::*`
oracle	weblogic_server	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:::::::*`
oracle	weblogic_server	14.1.1.0.0	-	-	`cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

[ws-dev] 20200219 [jira] [Created] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
cve.org

访问

[ws-commits] 20200219 [ws-wss4j] branch 2_2_x-fixes updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
cve.org

访问

[ws-dev] 20200219 [jira] [Resolved] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
cve.org

访问

[ws-commits] 20200219 [ws-wss4j] branch master updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
cve.org

访问

[ws-dev] 20200318 [jira] [Closed] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226 mailing-list
cve.org

访问

[tomee-commits] 20201013 [jira] [Created] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
cve.org

访问

[tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
cve.org

访问

[tomee-commits] 20210426 [jira] [Commented] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
cve.org

访问

[tomee-commits] 20210426 [jira] [Updated] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
cve.org

访问

[tomee-commits] 20210426 [jira] [Comment Edited] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability mailing-list
cve.org

访问