| Package | Affected versions | Patched versions |
|---|---|---|
| org.cryptacular:cryptacular | ≥ 1.2.0, < 1.2.4< 1.1.4 | 1.2.41.1.4 |
| communications services gatekeeper | = 7.0 | |
| webcenter sites | = 12.2.1.3.0= 12.2.1.4.0 | |
| weblogic server | = 12.2.1.4.0= 14.1.1.0.0 | |
| cryptacular | ≥ 1.2.0, < 1.2.4< 1.1.4 | 1.2.41.1.4 |
CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free