CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocatio

Summary

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

Timeline

1. Jan 24, 2020, 2:17 PM UTCCVE published
2. Aug 4, 2024, 9:25 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.cryptacular:cryptacularMaven

  fixed in 1.1.4

• org.cryptacular:cryptacularMaven

  From 1.2.0 · fixed in 1.2.4

References 19