Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the…
Priority LOW 33CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 8 fixed, 12 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.
Summary
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Why it matters now
EPSS 0.07543 94th percentileScored 2026-11-07
Fix Partial org.apache.ws.security:wss4j (Maven): 1.6.17, 2.02wss4j:wss4j (Maven): 1.6.17Red Hat: 8 advisoriesRed Hat: 8 fixed, 12 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.ws.security:wss4j (Maven) | before 1.6.17 | 1.6.17 | Patch available | GHSA-6r5v-hp32-fjqw |
| — | org.apache.ws.security:wss4j (Maven) | 2.0.0 to before 2.02 | 2.02 | Patch available | GHSA-6r5v-hp32-fjqw |
| — | wss4j:wss4j (Maven) | before 1.6.17 | 1.6.17 | Patch available | GHSA-6r5v-hp32-fjqw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.ws.security:wss4j (Maven) Vendor— Affected before 1.6.17 Fixed in 1.6.17 Patch available GHSA-6r5v-hp32-fjqw
- org.apache.ws.security:wss4j (Maven) Vendor— Affected 2.0.0 to before 2.02 Fixed in 2.02 Patch available GHSA-6r5v-hp32-fjqw
- wss4j:wss4j (Maven) Vendor— Affected before 1.6.17 Fixed in 1.6.17 Patch available GHSA-6r5v-hp32-fjqw
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* | up to 1.6.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:wss4j:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Apache |
- cpe:2.3:a:apache:wss4j:*:*:*:*:*:*:*:* Versions up to 1.6.16 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:wss4j:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
Remediation
- Fix · GHSA-6r5v-hp32-fjqw org.apache.ws.security:wss4j (Maven) Fixed in 1.6.17 Advisory →
- Fix · GHSA-6r5v-hp32-fjqw org.apache.ws.security:wss4j (Maven) Fixed in 2.02 Advisory →
- Fix · GHSA-6r5v-hp32-fjqw wss4j:wss4j (Maven) Fixed in 1.6.17 Advisory →
Red Hat 8 advisories
- RHSA-2015:1176 Released 2015-06-23 · Red Hat rating ImportantRed Hat JBoss Fuse 6.2.0 update
- Red Hat JBoss Fuse 6.2
- RHSA-2015:1177 Released 2015-06-23 · Red Hat rating ImportantRed Hat JBoss A-MQ 6.2.0 update
- Red Hat JBoss A-MQ 6.2
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
Show 5 more Red Hat advisories
- RHSA-2015:0848 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-commons-daemon-eap6-1:1.0.15-8.redhat_1.ep6.el7, apache-commons-io-eap6-2.1.0-1.redhat_4.1.ep6.el7, apache-commons-lang-eap6-2.6.0-1.redhat_4.1.ep6.el7 +47
- RHSA-2015:0846 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el5, apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el5, apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el5 +47
- RHSA-2015:0847 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-commons-cli-eap6-1.2.0-1.redhat_8.1.ep6.el6, apache-commons-codec-eap6-1.4.0-4.redhat_4.1.ep6.el6, apache-commons-configuration-eap6-1.6.0-1.redhat_4.2.ep6.el6 +47
- RHSA-2015:0849 Released 2015-04-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.0 update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2015:0773 Released 2015-04-01 · Red Hat rating ImportantRed Hat JBoss Data Grid 6.4.1 update
- Red Hat JBoss Data Grid 6.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix yet |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.2 | Fixed | RHSA-2015:1177 |
| Red Hat JBoss Data Grid 6.4 | Fixed | RHSA-2015:0773 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2015:0849 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2015:0846 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2015:0847 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2015:0848 |
| Red Hat JBoss Fuse 6.2 | Fixed | RHSA-2015:1176 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
Not affected: 1 product
- Red Hat JBoss Operations Network 2
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0227
- 2026-10-03 Alias added: GHSA-6r5v-hp32-fjqw
References
Advisory 8
More Apache Wss4j vulnerabilities
- TI-2020-10913 Velocity Sandbox Bypass CVSS 3.1HIGH 8.8
- TI-2026-60291 Apache WSS4J: SAML Sender-Vouches Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2026-60412 Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection CVSS 3.1CRITICAL 9.1
- TI-2026-59946 Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. CVSS 3.1CRITICAL 9.1
- TI-2015-00198 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about… CVSS 3.0HIGH 7.5
- TI-2026-62217 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference CVSS 3.1HIGH 7.5
Sources
- CVE-2015-0227 · CVE Program
- CVE-2015-0227 · NVD
- FIRST EPSS
- GHSA-6r5v-hp32-fjqw · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0227 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences