CVE-2022-29249 - OpenCVE

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Javaez Project	Javaez

Configuration 1 [-]

cpe:2.3:a:javaez_project:javaez:1.6:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7
https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-05-24T15:15:13

Updated: 2024-08-03T06:17:54.476Z

Reserved: 2022-04-13T00:00:00

Link: CVE-2022-29249

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-05-24T16:15:07.953

Modified: 2023-07-21T16:54:46.130

Link: CVE-2022-29249

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "JavaEZ", "vendor": "JavaEZLib", "versions": [{"status": "affected", "version": "= 1.6"}]}], "descriptions": [{"lang": "en", "value": "JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-327", "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-328", "description": "CWE-328: Reversible One-Way Hash", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-24T15:15:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7"}], "source": {"advisory": "GHSA-67fj-6w6m-w5j8", "discovery": "UNKNOWN"}, "title": "Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-29249", "STATE": "PUBLIC", "TITLE": "Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "JavaEZ", "version": {"version_data": [{"version_value": "= 1.6"}]}}]}, "vendor_name": "JavaEZLib"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"}]}, {"description": [{"lang": "eng", "value": "CWE-328: Reversible One-Way Hash"}]}]}, "references": {"reference_data": [{"name": "https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8", "refsource": "CONFIRM", "url": "https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8"}, {"name": "https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7", "refsource": "MISC", "url": "https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7"}]}, "source": {"advisory": "GHSA-67fj-6w6m-w5j8", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:54.476Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-29249", "datePublished": "2022-05-24T15:15:13", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2024-08-03T06:17:54.476Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:javaez_project:javaez:1.6:*:*:*:*:*:*:*", "matchCriteriaId": "561C4FE7-6F7B-480E-9D08-B7BB3AFDC90D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading."}, {"lang": "es", "value": "JavaEZ es una biblioteca que a\u00f1ade nuevas funciones para facilitar el uso de Java. Una debilidad en JavaEZ versi\u00f3n 1.6 permite forzar el descifrado de texto bloqueado por actores no autorizados. El problema NO es cr\u00edtico para aplicaciones no seguras, sin embargo puede ser cr\u00edtico en una situaci\u00f3n en la que son requeridos los m\u00e1s altos niveles de seguridad. Este problema afecta SOLO a la versi\u00f3n v1.6 y no afecta a nada en versiones anteriores a 1.6. La vulnerabilidad ha sido parcheada en versi\u00f3n 1.7. Actualmente, no se presenta forma de arreglar el problema sin actualizar"}], "id": "CVE-2022-29249", "lastModified": "2023-07-21T16:54:46.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-05-24T16:15:07.953", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}, {"lang": "en", "value": "CWE-327"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "security-advisories@github.com", "type": "Secondary"}]}