https://bz.apache.org/bugzilla/show_bug.cgi?id=63953
Bug ID: 63953
Summary: Security : Fortify Privacy Violation
Product: POI
Version: 4.1.1-FINAL
Hardware: PC
Status: NEW
Severity: critical
Priority: P2
Component: POI Overall
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Fortify Report on POI source code identifies the following vulnerability:
Category: Privacy Violation (Security Features, Data Flow)
Description: The method write() in XOREncryptionVerifier.java mishandles
confidential information, which can compromise user privacy and is often
illegal.
@Override
public void write(LittleEndianByteArrayOutputStream bos) {
bos.write(getEncryptedKey());
bos.write(getEncryptedVerifier());
}
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
