CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

Project Subscriptions

Vendors Products
Communications Services Gatekeeper Subscribe
Webcenter Sites Subscribe
Weblogic Server Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Fuse Subscribe
Jboss Single Sign On Subscribe
Cryptacular Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2020-0522 CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
Github GHSA Github GHSA GHSA-x64g-4xx9-fh6x Denial of Service in Cryptacular
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45 cve-icon cve-icon
https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75 cve-icon cve-icon
https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f cve-icon cve-icon
https://github.com/apereo/cas/pull/4685 cve-icon cve-icon
https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153 cve-icon cve-icon
https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153 cve-icon cve-icon
https://github.com/vt-middleware/cryptacular/issues/52 cve-icon cve-icon
https://lists.apache.org/thread.html/r0847c7eb78c8f9e87d5b841fbd5da52b2ad4b4345e04b51c30621d88%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r209de85beae4d257d27fc577e3a3e97039bdb4c2dc6f4a8e5a5a5811%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2237a27040b57adc2fcc5570bd530ad2038e67fcb2a3ce65283d3143%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r380781f5b489cb3c818536cd3b3757e806bfe0bca188591e0051ac03%40%3Ccommits.ws.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r4a62133ad01d5f963755021027a4cce23f76b8674a13860d2978c7c8%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r77c48cd851f60833df9a9c9c31f12243508e15d1b2a0961066d44fc6%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rc36b75cabb4d700b48035d15ad8b8c2712bb32123572a1bdaec2510a%40%3Cdev.ws.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re04e4f8f0d095387fb6b0ff9016a0af8c93f42e1de93b09298bfa547%40%3Ccommits.ws.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/re7f46c4cc29a4616e0aa669c84a0eb34832e83a8eef05189e2e59b44%40%3Cdev.ws.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rfa4647c58e375996e62a9094bffff6dc350ec311ba955b430e738945%40%3Cdev.ws.apache.org%3E cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-7226 cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-7226 cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-04T09:25:48.474Z

Reserved: 2020-01-18T00:00:00

Link: CVE-2020-7226

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-01-24T15:15:14.093

Modified: 2024-11-21T05:36:52.113

Link: CVE-2020-7226

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-01-24T00:00:00Z

Links: CVE-2020-7226 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses