Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about…
Priority MEDIUM 41CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 9 fixed, 7 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.
Summary
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
Why it matters now
EPSS 0.05501 92nd percentileScored 2026-11-07
Fix Partial org.apache.ws.security:wss4j (Maven): 1.6.17org.apache.wss4j:wss4j-ws-security-dom (Maven): 2.0.2Red Hat: 9 advisoriesRed Hat: 9 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.ws.security:wss4j (Maven) | before 1.6.17 | 1.6.17 | Patch available | GHSA-vjwc-5hfh-2vv5 |
| — | org.apache.wss4j:wss4j-ws-security-dom (Maven) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-vjwc-5hfh-2vv5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.ws.security:wss4j (Maven) Vendor— Affected before 1.6.17 Fixed in 1.6.17 Patch available GHSA-vjwc-5hfh-2vv5
- org.apache.wss4j:wss4j-ws-security-dom (Maven) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-vjwc-5hfh-2vv5
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* | up to 1.6.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0:beta:*:*:*:*:*:* | 2.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* Versions up to 1.6.16 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0:beta:*:*:*:*:*:* Versions 2.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
Remediation
- Fix · GHSA-vjwc-5hfh-2vv5 org.apache.ws.security:wss4j (Maven) Fixed in 1.6.17 Advisory →
- Fix · GHSA-vjwc-5hfh-2vv5 org.apache.wss4j:wss4j-ws-security-dom (Maven) Fixed in 2.0.2 Advisory →
Red Hat 9 advisories
- RHSA-2016:1376 Released 2016-06-30 · Red Hat rating CriticalRed Hat JBoss SOA Platform security update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2015:1176 Released 2015-06-23 · Red Hat rating ImportantRed Hat JBoss Fuse 6.2.0 update
- Red Hat JBoss Fuse 6.2
- RHSA-2015:1177 Released 2015-06-23 · Red Hat rating ImportantRed Hat JBoss A-MQ 6.2.0 update
- Red Hat JBoss A-MQ 6.2
Show 6 more Red Hat advisories
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
- RHSA-2015:0848 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-commons-daemon-eap6-1:1.0.15-8.redhat_1.ep6.el7, apache-commons-io-eap6-2.1.0-1.redhat_4.1.ep6.el7, apache-commons-lang-eap6-2.6.0-1.redhat_4.1.ep6.el7 +47
- RHSA-2015:0846 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el5, apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el5, apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el5 +47
- RHSA-2015:0847 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el6, apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el6, apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el6 +47
- RHSA-2015:0849 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2015:0773 Released 2015-04-01 · Red Hat rating ImportantRed Hat JBoss Data Grid 6.4.1 update
- Red Hat JBoss Data Grid 6.4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix yet |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix yet |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.2 | Fixed | RHSA-2015:1177 |
| Red Hat JBoss Data Grid 6.4 | Fixed | RHSA-2015:0773 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2015:0849 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2015:0846 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2015:0847 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2015:0848 |
| Red Hat JBoss Fuse 6.2 | Fixed | RHSA-2015:1176 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2016:1376 |
Not affected: 2 products
- Red Hat JBoss Operations Network 2
- Red Hat JBoss SOA Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0226
- 2026-10-03 Alias added: GHSA-vjwc-5hfh-2vv5
References
Advisory 9
Other 6
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://github.com/apache/ws-wss4j/commit/970b3e3756e2c75bf2379ce198365e1a7168c3c3
- https://github.com/apache/ws-wss4j/commit/de5104b30ddde5fe7388ad57e1c5ace5c5509924
- https://github.com/apache/ws-wss4j
- https://svn.apache.org/viewvc?view=revision&revision=1621329
More Apache Wss4j vulnerabilities
- TI-2020-10913 Velocity Sandbox Bypass CVSS 3.1HIGH 8.8
- TI-2026-60291 Apache WSS4J: SAML Sender-Vouches Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2026-60412 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection CVSS 3.1CRITICAL 9.1
- TI-2026-59946 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. CVSS 3.1CRITICAL 9.1
- TI-2026-62217 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference CVSS 3.1HIGH 7.5
- TI-2026-58684 Apache WSS4J: Insufficient Validation of Derived-Key Parameters CVSS 3.1HIGH 7.5
Sources
- CVE-2015-0226 · CVE Program
- CVE-2015-0226 · NVD
- FIRST EPSS
- GHSA-vjwc-5hfh-2vv5 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0226 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences