Reversible One-Way Hash in io.github.javaezlib:JavaEZ

高 7.5CVE-2022-29249 · GHSA-67fj-6w6m-w5j8 · 24/05/2022 公開 · 17/06/2026 更新

要点

CVE-2022-29249 は io.github.javaezlib:JavaEZ, javaez (javaez project) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.75%（全脆弱性の 55.1% より高い）。
対処：1.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
io.github.javaezlib:JavaEZ Maven	`≥ 1.6, < 1.7`	`1.7`
javaez javaez_project	`= 1.6`	修正版なし

概要

Impact

This weakness allows the force decryption of locked text by hackers. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. Upgrading to 1.7 is advised.

Patches

The vulnerability has been patched in release 1.7.

Workarounds

Currently there is no way to fix the issue without upgrading.

References

CWE-327 CWE-328

For more information

If you have any questions or comments about this advisory:

Open an issue in our issue tracker
Email us at [email protected]

NVD の説明

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.