[WSS-252] org.apache.ws.security.processor.UsernameTokenProcessor is not thread safe/prone to hacker attacks

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Won't Fix
• Affects Version/s: 1.5.9
• Component/s: WSS4J Handlers
• Environment: Any
• Assignee: Colm O hEigeartaigh
• Reporter: Marek Cyzio
• Created: 16/Nov/10 20:45
• Updated: 03/Oct/11 09:02
• Resolved: 11/Feb/11 12:11

Description

The UsernameTokenProcessorshould be thread safe, but it caches the UsernameToken (ut) and its ID (utId). This may allow a hacker to access the system with incorrect password if two threads happen to go through the code in parallel.