org.apache.wss4j:wss4j-ws-security-stax 3.0.0

Direct Vulnerabilities

Known vulnerabilities in the org.apache.wss4j:wss4j-ws-security-stax package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Replay Attack Affected versions of this package are vulnerable to Replay Attack through the `UsernameTokenProcessor` and `UsernameTokenInputHandler` in its DOM and StAX inbound processing. An attacker who captures a valid password-digest UsernameToken can resend it with whitespace added to its Base64 Nonce; the digest still verifies, but the raw-text replay-cache lookup misses the token, allowing the attacker to reuse it on requests of their choosing and perform actions as the authenticated user until the token expires. The attack requires a configured nonce replay cache. How to fix Replay Attack? Upgrade `org.apache.wss4j:wss4j-ws-security-stax` to version 2.4.4, 3.0.6, 4.0.2 or higher.	[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)
H Improperly Implemented Security Check for Standard Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard via the `WSSSignatureReferenceVerifyInputProcessor` in the StAX signature-reference processing component. An attacker can send a SOAP message containing an STR-Transform signature reference that leaves the internal signed-content flag set, causing WS-SecurityPolicy to stop checking later `SignedParts` and `SignedElements`; required unsigned content can then be accepted, enabling XML Signature Wrapping attacks. Signature verification itself and the DOM implementation are unaffected. How to fix Improperly Implemented Security Check for Standard? Upgrade `org.apache.wss4j:wss4j-ws-security-stax` to version 2.4.4, 3.0.6, 4.0.2 or higher.	[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)
H Improper Validation of Specified Index, Position, or Offset in Input Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input through the `DerivedKeyTokenInputHandler` and `DerivedKeyUtils.deriveKey` in its StAX and common derived-key processing. An attacker can send a crafted WS-Security message with extreme derived-key length or offset values, causing excessive CPU and memory use during key derivation and disrupting message processing. Notes At the StAX entry point, the attacker supplies the DerivedKeyToken’s `wsc:Length` and `wsc:Offset`; the handler converts both with `BigInteger.intValue()` before derivation, so oversized XML integers are narrowed to signed 32-bit values and can wrap. How to fix Improper Validation of Specified Index, Position, or Offset in Input? Upgrade `org.apache.wss4j:wss4j-ws-security-stax` to version 2.4.4, 3.0.6, 4.0.2 or higher.	[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)

Vulnerability

Vulnerable Version

Replay Attack

Affected versions of this package are vulnerable to Replay Attack through the UsernameTokenProcessor and UsernameTokenInputHandler in its DOM and StAX inbound processing. An attacker who captures a valid password-digest UsernameToken can resend it with whitespace added to its Base64 Nonce; the digest still verifies, but the raw-text replay-cache lookup misses the token, allowing the attacker to reuse it on requests of their choosing and perform actions as the authenticated user until the token expires. The attack requires a configured nonce replay cache.

How to fix Replay Attack?

Upgrade org.apache.wss4j:wss4j-ws-security-stax to version 2.4.4, 3.0.6, 4.0.2 or higher.

[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)

Improperly Implemented Security Check for Standard

Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard via the WSSSignatureReferenceVerifyInputProcessor in the StAX signature-reference processing component. An attacker can send a SOAP message containing an STR-Transform signature reference that leaves the internal signed-content flag set, causing WS-SecurityPolicy to stop checking later SignedParts and SignedElements; required unsigned content can then be accepted, enabling XML Signature Wrapping attacks. Signature verification itself and the DOM implementation are unaffected.

How to fix Improperly Implemented Security Check for Standard?

Upgrade org.apache.wss4j:wss4j-ws-security-stax to version 2.4.4, 3.0.6, 4.0.2 or higher.

[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)

Improper Validation of Specified Index, Position, or Offset in Input

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input through the DerivedKeyTokenInputHandler and DerivedKeyUtils.deriveKey in its StAX and common derived-key processing. An attacker can send a crafted WS-Security message with extreme derived-key length or offset values, causing excessive CPU and memory use during key derivation and disrupting message processing.

Notes

At the StAX entry point, the attacker supplies the DerivedKeyToken’s wsc:Length and wsc:Offset; the handler converts both with BigInteger.intValue() before derivation, so oversized XML integers are narrowed to signed 32-bit values and can wrap.

How to fix Improper Validation of Specified Index, Position, or Offset in Input?

Upgrade org.apache.wss4j:wss4j-ws-security-stax to version 2.4.4, 3.0.6, 4.0.2 or higher.

[,2.4.4)[3.0.0,3.0.6)[4.0.0,4.0.2)

org.apache.wss4j:wss4j-ws-security-stax@3.0.0

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically