ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Colm O hEigeartaigh <>
Subject Two new security advisories released for Apache WSS4J
Date Tue, 10 Feb 2015 11:41:37 GMT
Two new security advisories have been released for Apache WSS4J:

1) CVE-2015-0226: Apache WSS4J is (still) vulnerable to Bleichenbacher's

2) CVE-2015-0227: Apache WSS4J doesn't correctly enforce the
requireSignedEncryptedDataElements property

Please note that both of these advisories were fixed in WSS4J 2.0.2 and
1.6.17, both of which were released last year.


Colm O hEigeartaigh

Talend Community Coder

View raw message