• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Paul Clapham
  • Ron McLeod
  • Tim Cooke
  • Junilu Lacar
Sheriffs:
  • Rob Spoor
  • Devaka Cooray
  • Jeanne Boyarsky
Saloon Keepers:
  • Jesse Silverman
  • Stephan van Hulst
  • Tim Moores
  • Carey Brown
  • Tim Holloway
Bartenders:
  • Jj Roberts
  • Al Hobbs
  • Piet Souris

To Fix Vulnerability (CVE-2015-0226) needed to upgrade from Wss4j-1.5.4 to Wss4j-1.6.17

 
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Hi Folks,

To fix the vulnerability it's needed to upgrade wss4j-1.5.4 to wss4j-1.6.17

Where wss4j-1.6.17 is not backward compatible and breaks lots of existing code.

Is there any patch or recommendations are there to fix the vulnerability CVE-2015-0226 without breaking the existing written code?
 
Saloon Keeper
Posts: 7161
165
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Welcome to the Ranch.

If that's the only thing you need to fix you can build your own version. https://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/main/java/org/apache/wss4j/dom/processor/EncryptedKeyProcessor.java?r1=1619359&r2=1621329&pathrev=1621329 is apparently the diff to fix this; it looks very contained. You can find that by starting from https://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc
 
ajaykumar jaiswal
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
This one I have seen over the internet and the problem is in wss4j-1.5.4

those methods are not there like getRandomKey is not there in wss4j-1.5.4 in EncryptedKeyProcessor.


Here are the GitHub link:

1.5.4 : https://github.com/apache/ws-wss4j/blob/1_5_4/src/org/apache/ws/security/processor/EncryptedKeyProcessor.java

1.6.17 : https://github.com/apache/ws-wss4j/blob/wss4j-1.6.17/src/main/java/org/apache/ws/security/processor/EncryptedKeyProcessor.java
 
You showed up just in time for the waffles! And this tiny ad:
Building a Better World in your Backyard by Paul Wheaton and Shawn Klassen-Koop
https://coderanch.com/wiki/718759/books/Building-World-Backyard-Paul-Wheaton
reply
    Bookmark Topic Watch Topic
  • New Topic