CVE-2020-7226 – cryptacular: excessive memory allocation during a decode operation

https://notcve.org/view.php?id=CVE-2020-7226

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data. El archivo CiphertextHeader.java en Cryptacular versión 1.2.3, como es usado en Apereo CAS y otros productos, permite a atacantes activar una asignación de memoria excesiva durante una operación de decodificación, porque la longitud de la matriz nonce asociada con el "new byte" puede depender de una entrada no confiable dentro del encabezado de datos codificados. • https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45 https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75 https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101f https://github.com/apereo/cas/pull/4685 https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153 https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153 https://github • CWE-770: Allocation of Resources Without Limits or Throttling •