| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.ws.security:wss4j | ≥ 2.0.0, < 2.02< 1.6.17 | 2.021.6.17 |
| wss4j:wss4j | < 1.6.17 | 1.6.17 |
| wss4j | = 2.0.0= 2.0.1≤ 1.6.16 |
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free