CVE-2020-7226
cryptacular: excessive memory allocation during a decode operation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
El archivo CiphertextHeader.java en Cryptacular versión 1.2.3, como es usado en Apereo CAS y otros productos, permite a atacantes activar una asignación de memoria excesiva durante una operación de decodificación, porque la longitud de la matriz nonce asociada con el "new byte" puede depender de una entrada no confiable dentro del encabezado de datos codificados.
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.1 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.0, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.1 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include bypass, cross site scripting, out of bounds read, and traversal vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-18 CVE Reserved
- 2020-01-24 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (21)
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-7226 | 2020-12-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1801380 | 2020-12-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vt Search vendor "Vt" | Cryptacular Search vendor "Vt" for product "Cryptacular" | < 1.1.4 Search vendor "Vt" for product "Cryptacular" and version " < 1.1.4" | - |
Affected
| ||||||
| Vt Search vendor "Vt" | Cryptacular Search vendor "Vt" for product "Cryptacular" | >= 1.2.0 < 1.2.4 Search vendor "Vt" for product "Cryptacular" and version " >= 1.2.0 < 1.2.4" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Services Gatekeeper Search vendor "Oracle" for product "Communications Services Gatekeeper" | 7.0 Search vendor "Oracle" for product "Communications Services Gatekeeper" and version "7.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Webcenter Sites Search vendor "Oracle" for product "Webcenter Sites" | 12.2.1.3.0 Search vendor "Oracle" for product "Webcenter Sites" and version "12.2.1.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Webcenter Sites Search vendor "Oracle" for product "Webcenter Sites" | 12.2.1.4.0 Search vendor "Oracle" for product "Webcenter Sites" and version "12.2.1.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Weblogic Server Search vendor "Oracle" for product "Weblogic Server" | 12.2.1.4.0 Search vendor "Oracle" for product "Weblogic Server" and version "12.2.1.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Weblogic Server Search vendor "Oracle" for product "Weblogic Server" | 14.1.1.0.0 Search vendor "Oracle" for product "Weblogic Server" and version "14.1.1.0.0" | - |
Affected
| ||||||