PT-2022-19496 · Javaez · Javaez

Published 2022-05-24 · Updated 2023-07-21 · CVE-2022-29249

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JavaEZ version 1.6

Description A weakness in JavaEZ allows force decryption of locked text by unauthorized actors. The issue may be critical in situations where the highest levels of security are required, but it is not critical for non-secure applications.

Recommendations For JavaEZ version 1.6, upgrade to release 1.7 to patch the vulnerability. Currently, there is no way to fix the issue without upgrading.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-327

CWE-326

CWE-328

Related Identifiers

CVE-2022-29249

GHSA-67FJ-6W6M-W5J8

Affected Products

Javaez

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29249.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29249 · Security Note
• https://osv.dev/vulnerability/GHSA-67fj-6w6m-w5j8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29249 · Vendor Advisory
• https://t.me/cibsecurity/43279 · Telegram Post
• https://t.me/cvenotify/31164 · Telegram Post
• https://github.com/JavaEZLib/JavaEZ · Note
• https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7 · Note
• https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8 · Note