CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products…
Priority LOW 39CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
Why it matters now
EPSS 0.03334 88th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial org.cryptacular:cryptacular (Maven): 1.1.4, 1.2.4Red Hat: 10 advisoriesRed Hat: 10 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.cryptacular:cryptacular (Maven) | before 1.1.4 | 1.1.4 | Patch available | GHSA-x64g-4xx9-fh6x |
| — | org.cryptacular:cryptacular (Maven) | 1.2.0 to before 1.2.4 | 1.2.4 | Patch available | GHSA-x64g-4xx9-fh6x |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.cryptacular:cryptacular (Maven) Vendor— Affected before 1.1.4 Fixed in 1.1.4 Patch available GHSA-x64g-4xx9-fh6x
- org.cryptacular:cryptacular (Maven) Vendor— Affected 1.2.0 to before 1.2.4 Fixed in 1.2.4 Patch available GHSA-x64g-4xx9-fh6x
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vt:cryptacular:*:*:*:*:*:*:*:* | before 1.1.4; 1.2.0 to before 1.2.4 | Vulnerable | Vt |
| cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* | 14.1.1.0.0 | Vulnerable | Oracle |
- cpe:2.3:a:vt:cryptacular:*:*:*:*:*:*:*:* Versions before 1.1.4; 1.2.0 to before 1.2.4 Vulnerable ·Vt
- cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-x64g-4xx9-fh6x org.cryptacular:cryptacular (Maven) Fixed in 1.1.4 Advisory →
- Fix · GHSA-x64g-4xx9-fh6x org.cryptacular:cryptacular (Maven) Fixed in 1.2.4 Advisory →
Red Hat 10 advisories
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
- RHSA-2020:2511 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
- RHSA-2020:2512 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
Show 7 more Red Hat advisories
- RHSA-2020:2513 Released 2020-06-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
- RHSA-2020:2515 Released 2020-06-10 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.1 Security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2020:2112 Released 2020-05-12 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.8 security update
- Red Hat Single Sign On 7.3.8
- RHSA-2020:2061 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 security update
- Red Hat JBoss EAP 7.2
- RHSA-2020:2060 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
- RHSA-2020:2059 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
- RHSA-2020:2058 Released 2020-05-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:2061 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:2058 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:2059 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:2060 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:2513 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:2511 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:2512 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2020:2515 |
| Red Hat Single Sign On 7.3.8 | Fixed | RHSA-2020:2112 |
Not affected: 2 products
- Red Hat Decision Manager 7
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7226
- 2026-10-03 Alias added: GHSA-x64g-4xx9-fh6x
- 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat
References
Exploit 3
- https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153
- https://github.com/vt-middleware/cryptacular/issues/52
- https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153
Patch 6
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/apereo/cas/pull/4685
- https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45
- https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75
- https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f
Other 24
- [ws-dev] 20200219 [jira] [Created] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226
- [ws-commits] 20200219 [ws-wss4j] branch 2_2_x-fixes updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226
- [ws-dev] 20200219 [jira] [Resolved] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226
- [ws-commits] 20200219 [ws-wss4j] branch master updated: WSS-665 - Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226
- [ws-dev] 20200318 [jira] [Closed] (WSS-665) Add cryptacular dependency and upgrade to 1.2.4 to fix CVE-2020-7226
- [tomee-commits] 20201013 [jira] [Created] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability
- [tomee-commits] 20201013 [jira] [Assigned] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability
- [tomee-commits] 20210426 [jira] [Commented] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability
- [tomee-commits] 20210426 [jira] [Updated] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability
- [tomee-commits] 20210426 [jira] [Comment Edited] (TOMEE-2908) TomEE plus is affected by CVE-2020-7226 (BDSA-2020-2333) vulnerability
- https://github.com/vt-middleware/cryptacular/pull/56
- https://github.com/vt-middleware/cryptacular/commit/311baf12252abf21947afd07bf0a0291ec3ec796
- https://github.com/vt-middleware/cryptacular/commit/ec2fb65f2455c479376695e3d75d30c7f6884b3f
- https://lists.apache.org/thread.html/rfa4647c58e375996e62a9094bffff6dc350ec311ba955b430e738945@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/re7f46c4cc29a4616e0aa669c84a0eb34832e83a8eef05189e2e59b44@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/re04e4f8f0d095387fb6b0ff9016a0af8c93f42e1de93b09298bfa547@%3Ccommits.ws.apache.org%3E
- https://lists.apache.org/thread.html/rc36b75cabb4d700b48035d15ad8b8c2712bb32123572a1bdaec2510a@%3Cdev.ws.apache.org%3E
- https://lists.apache.org/thread.html/r77c48cd851f60833df9a9c9c31f12243508e15d1b2a0961066d44fc6@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r4a62133ad01d5f963755021027a4cce23f76b8674a13860d2978c7c8@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r380781f5b489cb3c818536cd3b3757e806bfe0bca188591e0051ac03@%3Ccommits.ws.apache.org%3E
- https://lists.apache.org/thread.html/r2237a27040b57adc2fcc5570bd530ad2038e67fcb2a3ce65283d3143@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r209de85beae4d257d27fc577e3a3e97039bdb4c2dc6f4a8e5a5a5811@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r0847c7eb78c8f9e87d5b841fbd5da52b2ad4b4345e04b51c30621d88@%3Ccommits.tomee.apache.org%3E
- https://github.com/vt-middleware/cryptacular
Sources
- CVE-2020-7226 · CVE Program
- CVE-2020-7226 · NVD
- FIRST EPSS
- GHSA-x64g-4xx9-fh6x · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7226 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences