CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-7226
High (7.5). EPSS 3.3% chance of exploitation in the next 30 days. Fixed in org.cryptacular:cryptacular 1.1.4, 1.2.4.
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
Severity
- EPSS
- 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- oracle:communications_services_gatekeeper
- oracle:webcenter_sites
- oracle:weblogic_server
- vt:cryptacular
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x64g-4xx9-fh6x | Maven | org.cryptacular:cryptacular | <1.1.4 | 1.1.4 |
| GHSA-x64g-4xx9-fh6x | Maven | org.cryptacular:cryptacular | >=1.2.0 <1.2.4 | 1.2.4 |
References
- https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45
- https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75
- https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f
- https://github.com/apereo/cas/pull/4685
- https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153