Apache Software Foundation Web Services Security for Java 2.0.0 Release Candidate 1

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:wss4j:2.0.0:rc1:*:*:*:*:*:*

part: a version: 2.0.0 update: rc1

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductWss4J (9d5c9c57-125c-55c8-9713-e2dd9cb367ce)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:apache/ws purl2cpe 2026-06-01 10:14:25.329391
pkg:deb/debian/wss4j purl2cpe 2026-06-01 10:14:25.329392
pkg:deb/ubuntu/wss4j purl2cpe 2026-06-01 10:14:25.329394
pkg:github/apache/ws-wss4j purl2cpe 2026-06-01 10:14:25.329395
pkg:maven/org.apache.wss4j/wss4j purl2cpe 2026-06-01 10:14:25.329396

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2015-0227 vulnerable 2026-06-08 05:06:13.997859 Details available
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Published: 2015-02-12T16:00:00.000Z
Updated: 2024-08-06T04:03:10.283Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-0226 vulnerable 2026-06-08 05:06:13.996823 Details available
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
Published: 2017-10-30T14:00:00.000Z
Updated: 2024-08-06T04:03:10.543Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.