Vulnerability · Published May 24, 2022 · Assigned by GitHub_M

CVE-2022-29249Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

High 7.5

In plain English

A high-severity broken cryptography in JavaEZ from JavaEZLib. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 45.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.github.javaezlib:JavaEZ	1.7	GHSA-67fj-6w6m-w5j8

Affected products (as reported)

Vendor	Product	Versions
JavaEZLib	JavaEZ	= 1.6

Weakness: CWE-327, CWE-328 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8 x_refsource_CONFIRM
https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7 x_refsource_MISC