[Bug 1801380] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

List overview All Threads
Download

newer

older

[Bug 1864680] New: CVE-2019-17638...

[Bug 1738673] CVE-2019-10219...

bugzilla＠redhat.com

10 Feb 2020 10 Feb '20

10:22 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

Bug ID: 1801380 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, asoldano@redhat.com, atangrin@redhat.com, bbaranow@redhat.com, bmaxwell@redhat.com, brian.stansberry@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, darran.lofthouse@redhat.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jochrist@redhat.com, jperkins@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, lef@fedoraproject.org, lgao@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msvehla@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pdrozd@redhat.com, pjindal@redhat.com, pmackay@redhat.com, psotirop@redhat.com, puntogil@libero.it, rguimara@redhat.com, rrajasek@redhat.com, rsvoboda@redhat.com, rsynek@redhat.com, sdaley@redhat.com, smaestri@redhat.com, sthorger@redhat.com, tom.jenkinson@redhat.com Target Milestone: --- Classification: Other

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.

Reference: https://github.com/vt-middleware/cryptacular/issues/52

-- You are receiving this mail because: You are on the CC list for the bug.

Show replies by date

bugzilla＠redhat.com

10 Feb 10 Feb

10:23 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1801381, 1801382

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1801381 [Bug 1801381] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1801382 [Bug 1801382] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10:23 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created cryptacular tracking bugs for this issue:

Affects: epel-7 [bug 1801382] Affects: fedora-all [bug 1801381]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10:23 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1801383

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

5:08 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

Ted (Jong Seok) Won jwon@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

17 Feb 17 Feb

5:03 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #5 from Paramvir jindal pjindal@redhat.com --- EAP 7.2.6 and RHSSO 7.3.6 ships cryptacular-1.2.0.redhat-1.jar which seems to be affected.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

11 May 11 May

1:10 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:2058 https://access.redhat.com/errata/RHSA-2020:2058

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:10 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:13 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:2059 https://access.redhat.com/errata/RHSA-2020:2059

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:13 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:16 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:2060 https://access.redhat.com/errata/RHSA-2020:2060

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:16 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:19 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2061 https://access.redhat.com/errata/RHSA-2020:2061

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1:19 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12 May 12 May

3:32 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

Product Security DevOps Team prodsec-dev@redhat.com changed:

--- Comment #12 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-7226

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10:17 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Single Sign On 7.3.8

Via RHSA-2020:2112 https://access.redhat.com/errata/RHSA-2020:2112

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10:17 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10 Jun 10 Jun

12:05 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:2511 https://access.redhat.com/errata/RHSA-2020:2511

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:06 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:24 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2515 https://access.redhat.com/errata/RHSA-2020:2515

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:24 p.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

11 Jun 11 Jun

12:08 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:2513 https://access.redhat.com/errata/RHSA-2020:2513

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:08 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:17 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:2512 https://access.redhat.com/errata/RHSA-2020:2512

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:17 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

24 Nov 24 Nov

11:30 a.m.

New subject: [Bug 1801380] CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation

https://bugzilla.redhat.com/show_bug.cgi?id=1801380 Bug 1801380 depends on bug 1801381, which changed state.

Bug 1801381 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1801381

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug.