This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/master by this push:
new 952c4cccd Updating website for release
952c4cccd is described below
commit 952c4cccd91feb4910f69337a3f302494be7b218
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Wed Sep 30 11:18:57 2026 +0100
Updating website for release
---
pom.xml | 4 -
src/site/resources/advisories/CVE-2026-85532.txt | 24 ++++
src/site/resources/advisories/CVE-2026-87830.txt | 24 ++++
src/site/resources/advisories/CVE-2026-88920.txt | 24 ++++
src/site/resources/advisories/CVE-2026-89238.txt | 23 +++
src/site/resources/advisories/CVE-2026-92121.txt | 24 ++++
src/site/resources/advisories/CVE-2026-92899.txt | 22 +++
src/site/resources/advisories/CVE-2026-95616.txt | 20 +++
src/site/site.xml | 9 +-
src/site/xdoc/axis.xml | 176 +++++++++++------------
src/site/xdoc/contributing.xml | 2 +-
src/site/xdoc/download.xml | 28 ++--
src/site/xdoc/index.xml | 26 ++--
src/site/xdoc/package.xml | 26 ++--
src/site/xdoc/security_advisories.xml | 20 ++-
15 files changed, 311 insertions(+), 141 deletions(-)
diff --git a/pom.xml b/pom.xml
index 980ae1fff..aaca3cb3a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -481,10 +481,6 @@
<artifactId>maven-jxr-plugin</artifactId>
<version>3.6.0</version>
</plugin>
- <plugin>
- <groupId>org.owasp</groupId>
- <artifactId>dependency-check-maven</artifactId>
- </plugin>
</plugins>
</reporting>
diff --git a/src/site/resources/advisories/CVE-2026-85532.txt
b/src/site/resources/advisories/CVE-2026-85532.txt
new file mode 100644
index 000000000..c51cf8a4c
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-85532.txt
@@ -0,0 +1,24 @@
+CVE-2026-85532: Apache WSS4J: Insufficient Validation of Derived-Key
Parameters
+
+Severity: moderate
+
+Affected versions:
+
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-common) 4.0.0 before 4.0.2
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-common) 3.0.0 before 3.0.6
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-common) before 2.4.4
+
+Description:
+
+Apache WSS4J accepted attacker-controlled derived-key lengths and offsets
without adequate bounds. This could permit cryptographically weak keys or
excessive CPU and memory consumption when processing crafted WS-Security
messages. The fixes enforce a minimum key length of 16 bytes, a maximum length
of 512 bytes, and a maximum offset of 4096 bytes.
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which
fix this issue.
+
+Credit:
+
+This issue was independently reported by Ho1aAs (GitHub: @HolaAsuka) and also
found using Claude agents to study the security of open-source projects (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-85532
+
diff --git a/src/site/resources/advisories/CVE-2026-87830.txt
b/src/site/resources/advisories/CVE-2026-87830.txt
new file mode 100644
index 000000000..dc3e341d3
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-87830.txt
@@ -0,0 +1,24 @@
+CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip
element-protection checks.
+
+Severity: low
+
+Affected versions:
+
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 4.0.0 before
4.0.2
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) 3.0.0 before
3.0.6
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-policy-stax) before 2.4.4
+
+Description:
+
+In the StAX streaming WS-SecurityPolicy validator, certain relative or
unsupported XPath expressions can be converted into paths that never match the
actual XML element path. A remote SOAP peer may therefore send a required
element without the expected signature or encryption.
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which
fix this issue.
+
+Credit:
+
+Reported by n0mi1k (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-87830
+
diff --git a/src/site/resources/advisories/CVE-2026-88920.txt
b/src/site/resources/advisories/CVE-2026-88920.txt
new file mode 100644
index 000000000..e797a6a21
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-88920.txt
@@ -0,0 +1,24 @@
+CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass
+
+Severity: important
+
+Affected versions:
+
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 4.0.0 before 4.0.2
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 3.0.0 before 3.0.6
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) before 2.4.4
+
+Description:
+
+An authentication bypass in the DOM security processor in Apache WSS4J allows
unauthenticated remote attackers to forge authenticated SOAP messages via a
crafted unsigned SAML sender-vouches assertion containing an
attacker-controlled key.
+
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which
fix this issue.
+
+Credit:
+
+Reported by n0mi1k (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-88920
diff --git a/src/site/resources/advisories/CVE-2026-89238.txt
b/src/site/resources/advisories/CVE-2026-89238.txt
new file mode 100644
index 000000000..1800f221e
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-89238.txt
@@ -0,0 +1,23 @@
+CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing
wrong protected-header selection
+
+Severity: important
+
+Affected versions:
+
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 4.0.0 before 4.0.2
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) 3.0.0 before 3.0.6
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-dom) before 2.4.4
+
+Description:
+
+WSS4J EncryptedHeader child confusion could promote an attacker-controlled
plaintext element as the decrypted header, leading to incorrect confidentiality
coverage and possible policy bypass.
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which
fix this issue.
+
+Credit:
+
+Reported by n0mi1k (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-89238
diff --git a/src/site/resources/advisories/CVE-2026-92121.txt
b/src/site/resources/advisories/CVE-2026-92121.txt
new file mode 100644
index 000000000..54517144f
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-92121.txt
@@ -0,0 +1,24 @@
+CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in
the streaming code after an STR-Transform reference
+
+Severity: moderate
+
+Affected versions:
+
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-stax) 4.0.0 before 4.0.2
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-stax) 3.0.0 before 3.0.6
+- Apache WSS4J (org.apache.wss4j:wss4j-ws-security-stax) before 2.4.4
+
+Description:
+
+In the WSS4J streaming (StAX) code, a signature reference using the
WS-Security STR-Transform leaves an internal "inside signed content" flag
permanently set. The WS-SecurityPolicy enforcer uses that flag to decide
whether an element needs checking, so it stops evaluating SignedParts and
SignedElements for the rest of the message. A policy requiring the SOAP Body to
be signed is then satisfied even when the Body carries no signature, removing
the protection against XML Signature Wrapping [...]
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix
this issue.
+
+Credit:
+
+Reported by n0mi1k (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-92121
+
diff --git a/src/site/resources/advisories/CVE-2026-92899.txt
b/src/site/resources/advisories/CVE-2026-92899.txt
new file mode 100644
index 000000000..cb6de6123
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-92899.txt
@@ -0,0 +1,22 @@
+CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by
re-encoding the Nonce
+
+Severity: moderate
+
+Affected versions:
+
+- Apache WSS4J 4.0.0 before 4.0.2
+- Apache WSS4J 3.0.0 before 3.0.6
+- Apache WSS4J before 2.4.4
+
+Description:
+
+Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a
captured token cannot be reused. It stored the Nonce as raw base64 text, but
authentication decodes that text and uses the bytes.The same bytes can be
written as base64 in several ways. An attacker who captured an authenticated
request could re-send it with a space added to the Nonce: the password digest
still verified, but the token no longer matched the remembered one, so the
replay was accepted. Since a UsernameTo [...]
+
+Credit:
+
+Reported by n0mi1k (finder)
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-92899
diff --git a/src/site/resources/advisories/CVE-2026-95616.txt
b/src/site/resources/advisories/CVE-2026-95616.txt
new file mode 100644
index 000000000..d552cf21d
--- /dev/null
+++ b/src/site/resources/advisories/CVE-2026-95616.txt
@@ -0,0 +1,20 @@
+CVE-2026-95616: Apache WSS4J: Unauthenticated denial of service via integer
overflow in DER parsing of X.509 certificate extensions
+
+Severity: important
+
+Affected versions:
+
+- Apache WSS4J 4.0.0 before 4.0.2
+- Apache WSS4J 3.0.0 before 3.0.6
+- Apache WSS4J before 2.4.4
+
+Description:
+
+An integer overflow in WSS4J's DER bounds check lets an oversized allocation
pass validation. An unauthenticated attacker can send a SOAP message carrying
an X.509 certificate whose SubjectKeyIdentifier extension declares a length of
0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference,
before the message is authenticated, so an eleven-byte extension triggers a 2
GB allocation. Repeated requests exhaust server memory.
+Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which
fix this issue.
+
+References:
+
+https://ws.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-95616
+
diff --git a/src/site/site.xml b/src/site/site.xml
index 0b2270551..d9cb7bd8a 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -23,11 +23,11 @@
</skin>
<bannerLeft>
<name>Apache WSS4J™</name>
- <href>http://ws.apache.org/wss4j</href>
+ <href>https://ws.apache.org/wss4j</href>
</bannerLeft>
<bannerRight>
- <src>http://activemq.apache.org/images/asf-logo.png</src>
- <href>http://www.apache.org</href>
+ <src>https://activemq.apache.org/images/asf-logo.png</src>
+ <href>https://www.apache.org</href>
</bannerRight>
<body>
<menu name="Apache WSS4J">
@@ -45,4 +45,3 @@
</body>
</project>
-
diff --git a/src/site/xdoc/axis.xml b/src/site/xdoc/axis.xml
index 79f6a5be8..159b2d3f4 100644
--- a/src/site/xdoc/axis.xml
+++ b/src/site/xdoc/axis.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -27,8 +27,8 @@ service deployment
descriptor (wsdd file) to add a WS-Security layer to the web service.
This is a step by step tutorial for deploying a simple service with
Username Token.<br></br>
-<br></br></subsection><subsection name="Prerequisites"><a
href="http://ws.apache.org/axis/";>Axis
-1.2</a> installed and configured on a <a
href="http://jakarta.apache.org/tomcat/";>Tomcat Server</a>.� This
+<br></br></subsection><subsection name="Prerequisites"><a
href="https://ws.apache.org/axis/";>Axis
+1.2</a> installed and configured on a <a
href="https://jakarta.apache.org/tomcat/";>Tomcat Server</a>.� This
tutorial was performed on a Linux machine with Tomcat 5.5.4/Java 1.5.0,
however, the setup should be similar on other application servers, or
other operating systems (like Windows) unless we stated otherwise.<br></br>
@@ -43,7 +43,7 @@ WEB-INF/lib directory. Many jar files will already exist.
Most of them
will already exist there but you can just overwrite them all.</li>
<li>You may need to restart Tomcat unless you have automatic
deployment/class loading turned on. Check the Axis Happiness Page
-(typically at http://localhost:8080/axis), make sure that the XML
+(typically at https://localhost:8080/axis), make sure that the XML
Security (xmlsec.jar) is listed under the "Optional Components" section.</li>
</ol>
<h4>Creating the Service</h4>
@@ -55,18 +55,18 @@ with Axis. Unless you have one already, create a deployment
descriptor
<ol start="2">
<br></br>
<span style="color: rgb(0, 0, 153);"><deployment
-xmlns="http://xml.apache.org/axis/wsdd/";
-xmlns:java="http://xml.apache.org/axis/wsdd/providers/java"></span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�<service
+xmlns="https://xml.apache.org/axis/wsdd/";
+xmlns:java="https://xml.apache.org/axis/wsdd/providers/java"></span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�<service
name="stock-wss-01" provider="java:RPC" style="document"
use="literal"></span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="className" value="samples.stock.StockQuoteService"/></span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="allowedMethods" value="getQuote"/></span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="scope" value="application"/></span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�</service></span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�</service></span><br
style="color: rgb(0, 0, 153);"></br>
<span style="color: rgb(0, 0, 153);"></deployment><br></br>
<br></br>
</span><li>deploy the service (using AxisAdmin):</li>
@@ -74,7 +74,7 @@ name="scope" value="application"/></span><br style="color:
rgb(0, 0, 153);"><
<ol>
<span style="color: rgb(0, 0, 153);">java
org.apache.axis.client.AdminClient
--lhttp://localhost:8080/axis/services/AdminService deploy.wsdd<br></br>
+-lhttps://localhost:8080/axis/services/AdminService deploy.wsdd<br></br>
</span>
</ol>
<h4>Creating the Client</h4>
@@ -82,8 +82,8 @@ org.apache.axis.client.AdminClient
<li>Use WSDL2Java to generate the client service bindings:<br></br>
<span style="color: rgb(0, 0, 153);">java
org.apache.axis.wsdl.WSDL2Java -o .
--Nhttp://fox:8080/axis/services/stock-wss-01 samples.stock.client
-http://fox:8080/axis/services/stock-wss-01?wsdl</span><br></br>
+-Nhttps://fox:8080/axis/services/stock-wss-01 samples.stock.client
+https://fox:8080/axis/services/stock-wss-01?wsdl</span><br></br>
<br></br>
A bunch of java classes will be created under samples/stock/client,
including the StockQuoteServiceServiceLocator.<br></br>
@@ -101,31 +101,31 @@ javax.xml.rpc.ServiceException;</span><br style="color:
rgb(0, 0, 153);"></br>
<br style="color: rgb(0, 0, 153);"></br>
<span style="color: rgb(0, 0, 153);">public class
StockServiceClient {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� public
+ <span style="color: rgb(0, 0, 153);">��� public
StockServiceClient() {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� public
+ <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">��� public
static void main(String[] args) throws ServiceException,
RemoteException {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
if (args.length == 0) {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
System.out.println("Usage:\njava StockServiceClient [symbol]");</span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
return;</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
StockQuoteServiceService locator = new
StockQuoteServiceServiceLocator();</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
StockQuoteService service = locator.getStockWss01();</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
float quote = service.getQuote(args[0]);</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
System.out.println("stock quote service returned " + args[0] + ": " +
quote);</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
<span style="color: rgb(0, 0, 153);">}</span><br></br>
<br></br>
</li>
@@ -146,30 +146,30 @@ If all went well, you should get the result:<br></br>
<li>Modify the deployment descriptor you created above to look like
this:<br></br>
<span style="color: rgb(0, 0, 153);"><deployment
-xmlns="http://xml.apache.org/axis/wsdd/";
-xmlns:java="http://xml.apache.org/axis/wsdd/providers/java"></span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�<service
+xmlns="https://xml.apache.org/axis/wsdd/";
+xmlns:java="https://xml.apache.org/axis/wsdd/providers/java"></span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�<service
name="stock-wss-01" provider="java:RPC" style="document"
use="literal"></span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;">�
+ <span style="color: rgb(0, 0, 153); font-weight: bold;">�
<requestFlow></span><br style="color: rgb(0, 0, 153); font-weight:
bold;"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;">��
+ <span style="color: rgb(0, 0, 153); font-weight: bold;">��
<handler
type="java:org.apache.ws.axis.security.WSDoAllReceiver"></span><br
style="color: rgb(0, 0, 153); font-weight: bold;"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;">���
+ <span style="color: rgb(0, 0, 153); font-weight: bold;">���
<parameter name="passwordCallbackClass" value="PWCallback"/></span><br
style="color: rgb(0, 0, 153); font-weight: bold;"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;">���
+ <span style="color: rgb(0, 0, 153); font-weight: bold;">���
<parameter name="action" value="UsernameToken"/></span><br style="color:
rgb(0, 0, 153); font-weight: bold;"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;"></span><span
style="color: rgb(0, 0, 153); font-weight: bold;">��
+ <span style="color: rgb(0, 0, 153); font-weight: bold;"></span><span
style="color: rgb(0, 0, 153); font-weight: bold;">��
</handler></span><br style="color: rgb(0, 0, 153); font-weight:
bold;"></br>
- <span style="color: rgb(0, 0, 153); font-weight: bold;">�
+ <span style="color: rgb(0, 0, 153); font-weight: bold;">�
</requestFlow></span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="className" value="samples.stock.StockQuoteService"/></span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="allowedMethods" value="getQuote"/></span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">� <parameter
+ <span style="color: rgb(0, 0, 153);">� <parameter
name="scope" value="application"/></span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�</service></span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�</service></span><br
style="color: rgb(0, 0, 153);"></br>
<span style="color: rgb(0, 0, 153);"></deployment><br></br>
<br></br>
</span>WSDoAllReceiver is an Axis handler that can be located in
@@ -197,33 +197,33 @@ org.apache.ws.security.WSPasswordCallback;</span><br
style="color: rgb(0, 0, 153
<br style="color: rgb(0, 0, 153);"></br>
<span style="color: rgb(0, 0, 153);">public class PWCallback
implements CallbackHandler {</span><span style="color: rgb(0, 0,
153);"></span><span style="color: rgb(0, 0, 153);"></span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">� � public void
+ <span style="color: rgb(0, 0, 153);">� � public void
handle(Callback[] callbacks)</span><span style="color: rgb(0, 0, 153);">
throws IOException, UnsupportedCallbackException {</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
for (int i = 0; i < callbacks.length; i++) {</span><br style="color: rgb(0,
0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
if (callbacks[i] instanceof WSPasswordCallback) {</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
WSPasswordCallback pc = (WSPasswordCallback)callbacks[i];<br></br>
-���������������
+���������������
// set the password given a username<br></br>
- </span>���������������
+ </span>���������������
<span style="color: rgb(0, 0, 153);">if
("wss4j".equals(pc.getIdentifier())) {</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�������������������
+ <span style="color: rgb(0, 0, 153);">�������������������
pc.setPassword("security");</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);"></span><span style="color: rgb(0, 0,
153);">�����������
+ <span style="color: rgb(0, 0, 153);"></span><span style="color: rgb(0, 0,
153);">�����������
} else {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
throw new UnsupportedCallbackException(</span><span style="color: rgb(0, 0,
153);">callbacks[i], "Unrecognized Callback");</span><br style="color: rgb(0,
0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
<span style="color: rgb(0, 0, 153);">}</span><br></br>
<span style="font-weight: bold;"></span><br></br>
<br></br>
@@ -244,10 +244,10 @@ You should now get an error:<br></br>
<br></br>
<span style="color: rgb(0, 0, 153);">Exception in thread "main"
AxisFault</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�faultCode:
-{http://schemas.xmlsoap.org/soap/envelope/}Server.generalException</span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�faultSubcode:</span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�faultString:
+ <span style="color: rgb(0, 0, 153);">�faultCode:
+{https://schemas.xmlsoap.org/soap/envelope/}Server.generalException</span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�faultSubcode:</span><br
style="color: rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">�faultString:
WSDoAllReceiver: Request does not contain required Security
header</span><br></br>
<br></br>
This is because your client is not configured to send a Username Token
@@ -258,24 +258,24 @@ yet, so the service is rejecting the request.<br></br>
client:<br></br>
<br></br>
<span style="color: rgb(0, 0, 153);"><deployment
-xmlns="http://xml.apache.org/axis/wsdd/";
-xmlns:java="http://xml.apache.org/axis/wsdd/providers/java"><br></br>
-�<transport name="http"
+xmlns="https://xml.apache.org/axis/wsdd/";
+xmlns:java="https://xml.apache.org/axis/wsdd/providers/java"><br></br>
+�<transport name="http"
pivot="java:org.apache.axis.transport.http.HTTPSender"/><br></br>
-� <globalConfiguration ><br></br>
-�� <requestFlow ><br></br>
-��� <handler
+� <globalConfiguration ><br></br>
+�� <requestFlow ><br></br>
+��� <handler
type="java:org.apache.ws.axis.security.WSDoAllSender" ><br></br>
-���� <parameter name="action"
+���� <parameter name="action"
value="UsernameToken"/><br></br>
-���� <parameter name="user" value="wss4j"/><br></br>
-���� <parameter name="passwordCallbackClass"
+���� <parameter name="user" value="wss4j"/><br></br>
+���� <parameter name="passwordCallbackClass"
value="samples.stock.client.PWCallback"/><br></br>
-���� <parameter name="passwordType"
+���� <parameter name="passwordType"
value="PasswordDigest"/><br></br>
-��� </handler><br></br>
-�� </requestFlow ><br></br>
-� </globalConfiguration ><br></br>
+��� </handler><br></br>
+�� </requestFlow ><br></br>
+� </globalConfiguration ><br></br>
</deployment></span><span style="color: rgb(0, 0, 153);"></span><br></br>
<br></br>
</li>
@@ -295,45 +295,45 @@
javax.security.auth.callback.UnsupportedCallbackException;</span><br style="colo
org.apache.ws.security.WSPasswordCallback;</span><br style="color: rgb(0, 0,
153);"></br>
<br style="color: rgb(0, 0, 153);"></br>
<span style="color: rgb(0, 0, 153);">/**</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�* PWCallback for the
+ <span style="color: rgb(0, 0, 153);">�* PWCallback for the
Client</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�*/</span><br style="color: rgb(0, 0,
153);"></br>
+ <span style="color: rgb(0, 0, 153);">�*/</span><br style="color: rgb(0, 0,
153);"></br>
<span style="color: rgb(0, 0, 153);">public class PWCallback
implements CallbackHandler {</span><br style="color: rgb(0, 0, 153);"></br>
<br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� /**</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���� *
+ <span style="color: rgb(0, 0, 153);">��� /**</span><br style="color:
rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">���� *
@see
javax.security.auth.callback.CallbackHandler#handle(javax.security.auth.callback.Callback[])</span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���� */</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� public void
+ <span style="color: rgb(0, 0, 153);">���� */</span><br style="color:
rgb(0, 0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">��� public void
handle(Callback[] callbacks) throws IOException,</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������������������
+ <span style="color: rgb(0, 0, 153);">�������������������
UnsupportedCallbackException {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
for (int i = 0; i < callbacks.length; i++) {</span><br style="color: rgb(0,
0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
if (callbacks[i] instanceof WSPasswordCallback) {</span><br style="color:
rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
WSPasswordCallback pc = (WSPasswordCallback)callbacks[i];</span><br
style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
// set the password given a username</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
if ("wss4j".equals(pc.getIdentifier())) {</span><br style="color: rgb(0, 0,
153);"></br>
- <span style="color: rgb(0, 0, 153);">�������������������
+ <span style="color: rgb(0, 0, 153);">�������������������
pc.setPassword("security");</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
} else {</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">���������������
+ <span style="color: rgb(0, 0, 153);">���������������
throw new UnsupportedCallbackException(callbacks[i], "Unrecognized
Callback");</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�����������
+ <span style="color: rgb(0, 0, 153);">�����������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">�������
+ <span style="color: rgb(0, 0, 153);">�������
}</span><br style="color: rgb(0, 0, 153);"></br>
- <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
+ <span style="color: rgb(0, 0, 153);">��� }</span><br style="color: rgb(0,
0, 153);"></br>
<span style="color: rgb(0, 0, 153);">}</span><br></br>
<br></br>
</li>
diff --git a/src/site/xdoc/contributing.xml b/src/site/xdoc/contributing.xml
index fba1a22c3..ce29e832e 100644
--- a/src/site/xdoc/contributing.xml
+++ b/src/site/xdoc/contributing.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/src/site/xdoc/download.xml b/src/site/xdoc/download.xml
index c9ea57d09..ef1ef33fa 100644
--- a/src/site/xdoc/download.xml
+++ b/src/site/xdoc/download.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -27,7 +27,7 @@ standards for Web Services.
Use the links below to download a distribution of Apache WSS4J from one of our
mirrors.
It is good practice to verify the integrity of the distribution files. Apache
WSS4J releases are
available under the
-<a href="http://www.apache.org/licenses/LICENSE-2.0";>Apache License, Version
2.0</a> - see the
+<a href="https://www.apache.org/licenses/LICENSE-2.0";>Apache License, Version
2.0</a> - see the
LICENSE.txt and NOTICE.txt files contained in each release artifact.
</p>
</subsection>
@@ -35,32 +35,32 @@ LICENSE.txt and NOTICE.txt files contained in each release
artifact.
<ul>
<li>
<p>
-The current stable release is Apache WSS4J 4.0.1:
+The current stable release is Apache WSS4J 4.0.2:
</p>
<p>
-<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/4.0.1/wss4j-4.0.1-source-release.zip";>wss4j-4.0.1-source-release.zip</a>
-(<a
href="https://downloads.apache.org/ws/wss4j/4.0.1/wss4j-4.0.1-source-release.zip.asc";>PGP</a>)
-(<a
href="https://downloads.apache.org/ws/wss4j/4.0.1/wss4j-4.0.1-source-release.zip.sha512";>SHA-512</a>)
+<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/4.0.2/wss4j-4.0.2-source-release.zip";>wss4j-4.0.2-source-release.zip</a>
+(<a
href="https://downloads.apache.org/ws/wss4j/4.0.2/wss4j-4.0.2-source-release.zip.asc";>PGP</a>)
+(<a
href="https://downloads.apache.org/ws/wss4j/4.0.2/wss4j-4.0.2-source-release.zip.sha512";>SHA-512</a>)
</p>
</li>
<li>
<p>
-The current release on the older 3.0.x-fixes branch is Apache WSS4J 3.0.5:
+The current release on the older 3.0.x-fixes branch is Apache WSS4J 3.0.6:
</p>
<p>
-<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/3.0.5/wss4j-3.0.5-source-release.zip";>wss4j-3.0.5-source-release.zip</a>
-(<a
href="https://downloads.apache.org/ws/wss4j/3.0.5/wss4j-3.0.5-source-release.zip.asc";>PGP</a>)
-(<a
href="https://downloads.apache.org/ws/wss4j/3.0.5/wss4j-3.0.5-source-release.zip.sha512";>SHA-512</a>)
+<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/3.0.6/wss4j-3.0.6-source-release.zip";>wss4j-3.0.6-source-release.zip</a>
+(<a
href="https://downloads.apache.org/ws/wss4j/3.0.6/wss4j-3.0.6-source-release.zip.asc";>PGP</a>)
+(<a
href="https://downloads.apache.org/ws/wss4j/3.0.6/wss4j-3.0.6-source-release.zip.sha512";>SHA-512</a>)
</p>
</li>
<li>
<p>
-The current release on the older 2.4.x-fixes branch is Apache WSS4J 2.4.3:
+The current release on the older 2.4.x-fixes branch is Apache WSS4J 2.4.4:
</p>
<p>
-<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/2.4.3/wss4j-2.4.3-source-release.zip";>wss4j-2.4.3-source-release.zip</a>
-(<a
href="https://downloads.apache.org/ws/wss4j/2.4.3/wss4j-2.4.3-source-release.zip.asc";>PGP</a>)
-(<a
href="https://downloads.apache.org/ws/wss4j/2.4.3/wss4j-2.4.3-source-release.zip.sha512";>SHA-512</a>)
+<a
href="https://www.apache.org/dyn/closer.lua/ws/wss4j/2.4.4/wss4j-2.4.4-source-release.zip";>wss4j-2.4.4-source-release.zip</a>
+(<a
href="https://downloads.apache.org/ws/wss4j/2.4.4/wss4j-2.4.4-source-release.zip.asc";>PGP</a>)
+(<a
href="https://downloads.apache.org/ws/wss4j/2.4.4/wss4j-2.4.4-source-release.zip.sha512";>SHA-512</a>)
</p>
</li>
</ul>
diff --git a/src/site/xdoc/index.xml b/src/site/xdoc/index.xml
index 702267c60..e3dc7522b 100644
--- a/src/site/xdoc/index.xml
+++ b/src/site/xdoc/index.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -24,35 +24,35 @@
The <b>Apache WSS4J™</b> project provides a Java implementation of the
primary security standards for Web Services, namely the OASIS Web Services
Security (WS-Security) specifications from the
-<a href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss";>OASIS
Web Services Security TC</a>. WSS4J provides an implementation of the following
+<a
href="https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss";>OASIS
Web Services Security TC</a>. WSS4J provides an implementation of the following
WS-Security standards:
</p>
<ul>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SOAPMessageSecurity.pdf";>
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SOAPMessageSecurity.pdf";>
SOAP Message Security 1.1</a>
</li>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-UsernameTokenProfile.pdf";>Username
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-UsernameTokenProfile.pdf";>Username
Token Profile 1.1</a>
</li>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-x509TokenProfile.pdf";>X.509
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-x509TokenProfile.pdf";>X.509
Certificate Token Profile 1.1</a>
</li>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SAMLTokenProfile.pdf";>SAML
Token
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SAMLTokenProfile.pdf";>SAML
Token
Profile 1.1</a>
</li>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-KerberosTokenProfile.pdf";>Kerberos
Token
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-KerberosTokenProfile.pdf";>Kerberos
Token
Profile 1.1</a>
</li>
<li>
-<a
href="http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SwAProfile.pdf";>SOAP
Messages with Attachments Profile 1.1</a>
+<a
href="https://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-SwAProfile.pdf";>SOAP
Messages with Attachments Profile 1.1</a>
</li>
<li>
-<a href="http://www.ws-i.org/Profiles/BasicSecurityProfile-1.1.html";>Basic
Security Profile 1.1</a>
+<a href="https://www.ws-i.org/Profiles/BasicSecurityProfile-1.1.html";>Basic
Security Profile 1.1</a>
</li>
</ul>
</subsection>
@@ -67,7 +67,7 @@ Profile 1.1</a>
<th>Jakarta</th>
</tr>
<tr>
-<td>WSS4J 4.0.x*</td>
+<td>WSS4J 4.0.x</td>
<td>17</td>
<td>4.0.x</td>
<td>5.x</td>
@@ -88,11 +88,15 @@ Profile 1.1</a>
<td>No</td>
</tr>
</table>
-<p>* Not yet released</p>
</subsection>
<subsection name="News">
<ul>
<li>
+<p><b>September 2026</b> -
+The Apache WSS4J team are pleased to announce the release of versions 4.0.2
and 3.0.6 and 2.4.4. These releases contain a significant number of bug fixes
and security updates. Several CVE issues have been addressed, see the <a
href="security_advisories.html">security advisories page</a> for more
information.
+</p>
+</li>
+<li>
<p><b>November 2025</b> -
The Apache WSS4J team are pleased to announce the release of version 4.0.1 and
3.0.5.
</p>
diff --git a/src/site/xdoc/package.xml b/src/site/xdoc/package.xml
index 807ddb392..38e186f4e 100644
--- a/src/site/xdoc/package.xml
+++ b/src/site/xdoc/package.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -41,8 +41,8 @@ for Java) to process the SOAP messages. WSS4J in turn uses
the Apache XML Securi
project to handle XML Security according to XML Signature and XML Encryption.
<ul>
- <li><a href="http://ws.apache.org/wss4j/index.html";>WSS4J</a></li>
- <li><a href="http://xml.apache.org/security/index.html";>XML Security</a></li>
+ <li><a href="https://ws.apache.org/wss4j/index.html";>WSS4J</a></li>
+ <li><a href="https://xml.apache.org/security/index.html";>XML
Security</a></li>
</ul>
The WSS4J Axis handlers require Axis V1.2 because of some problems in previous
@@ -52,7 +52,7 @@ Axis versions. WSS4J CVS contains the latest Axis libraries.
The OASIS WSS specifications define a number of features and it is possible
to combine them in several ways. The WSS4J Axis handlers already support
a large number of WSS features and their combinations.
-<a href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss";>
+<a href="https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss";>
Here</a> are the WSS specifications.
</p></section><section name="The basics - a simple example that uses"><p>
@@ -119,11 +119,11 @@ The WSS4J Axis security handler interprets the parameter
values and controls
the WSS4J modules to generate the following SOAP request:
<source>
<?xml version="1.0" encoding="UTF-8"?>
-<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/";
- xmlns:xsd="http://www.w3.org/2001/XMLSchema";
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<soapenv:Envelope xmlns:soapenv="https://schemas.xmlsoap.org/soap/envelope/";
+ xmlns:xsd="https://www.w3.org/2001/XMLSchema";
+ xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
<soapenv:Header>
- <wsse:Security
xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/07/secext";
+ <wsse:Security
xmlns:wsse="https://schemas.xmlsoap.org/ws/2002/07/secext";
soapenv:mustUnderstand="true">
<wsse:UsernameToken>
<wsse:Username>werner</wsse:Username>
@@ -132,9 +132,9 @@ the WSS4J modules to generate the following SOAP request:
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
- <Ping xmlns="http://xmlsoap.org/Ping">
+ <Ping xmlns="https://xmlsoap.org/Ping">
<text>Scenario 1 text</text>
- <ticket xmlns:ns1="http://xmlsoap.org/Ping";
+ <ticket xmlns:ns1="https://xmlsoap.org/Ping";
xsi:type="ns1:ticketType">scenario1</ticket>
</Ping>
</soapenv:Body>
@@ -333,7 +333,7 @@ The Axis deplyment descriptor for this use case:
<parameter name="encryptionUser"
value="16c73ab6-b892-458f-abf5-2f875f74882e" />
<parameter name="encryptionParts"
-
value="{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken";
/>
+
value="{Element}{https://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken";
/>
</handler>
</requestFlow>
</source>
@@ -363,7 +363,7 @@ This descriptor contains some new parameters to control the
<code>UsernameToken
the whole SOAP Body in <code>Content</code> mode. The value of the
parameter in this example specifies to encrypt the element <code>
UsernameToken</code>, contained in the namespace
- <code>http://schemas.xmlsoap.org/ws/2002/07/secext</code>. The encryption
+ <code>https://schemas.xmlsoap.org/ws/2002/07/secext</code>. The encryption
module uses the <code>Element</code> mode to encrypt the element data.
Please refer to the
{@link org.apache.ws.security.handler.WSHandlerConstants#ENCRYPTION_PARTS
@@ -478,7 +478,7 @@ A deployment descriptor to chain handlers:
<parameter name="passwordCallbackClass"
value="org.apache.ws.axis.oasis.PWCallback"/>
<parameter name="signaturePropFile" value="crypto.properties" />
- <parameter name="signatureParts"
value="{}{http://xmlsoap.org/Ping}ticket"; />
+ <parameter name="signatureParts"
value="{}{https://xmlsoap.org/Ping}ticket"; />
</handler>
<handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
<parameter name="action" value="Signature"/>
diff --git a/src/site/xdoc/security_advisories.xml
b/src/site/xdoc/security_advisories.xml
index 40d5cc069..396f19386 100644
--- a/src/site/xdoc/security_advisories.xml
+++ b/src/site/xdoc/security_advisories.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -24,6 +24,16 @@ For information on how to report a new security problem
please see <a href="http
<p>
The following security advisories have been issued for Apache WSS4J™:
<ul>
+<li><b>2026</b></li>
+<ul>
+<li><a href="advisories/CVE-2026-85532.txt">CVE-2026-85532</a> - Apache WSS4J:
Insufficient Validation of Derived-Key Parameters.</li>
+<li><a href="advisories/CVE-2026-87830.txt">CVE-2026-87830</a> - Apache WSS4J:
Streaming WS-SecurityPolicy validation may skip element-protection checks.</li>
+<li><a href="advisories/CVE-2026-88920.txt">CVE-2026-88920</a> - Apache WSS4J:
SAML Sender-Vouches Authentication Bypass.</li>
+<li><a href="advisories/CVE-2026-89238.txt">CVE-2026-89238</a> - Apache WSS4J:
WSS4J EncryptedHeader child confusion causing wrong protected-header
selection.</li>
+<li><a href="advisories/CVE-2026-92121.txt">CVE-2026-92121</a> - Apache WSS4J:
WS-SecurityPolicy signature checks skipped in the streaming code after an
STR-Transform reference.</li>
+<li><a href="advisories/CVE-2026-92899.txt">CVE-2026-92899</a> - Apache WSS4J:
UsernameToken replay protection bypassed by re-encoding the Nonce.</li>
+<li><a href="advisories/CVE-2026-95616.txt">CVE-2026-95616</a> - Apache WSS4J:
Unauthenticated denial of service via integer overflow in DER parsing of X.509
certificate extensions.</li>
+</ul>
<li><b>2015</b></li>
<ul>
<li><a href="advisories/CVE-2015-0226.txt.asc">CVE-2015-0226</a> - Apache
@@ -42,13 +52,13 @@ the best way to keep an eye on security issues involving
WSS4J is to look at
the security advisories pages of these projects.
</p>
<p>
-The security advisory page for Apache CXF is <a
href="http://cxf.apache.org/security-advisories.html";>here</a>. In particular,
the following security
+The security advisory page for Apache CXF is <a
href="https://cxf.apache.org/security-advisories.html";>here</a>. In particular,
the following security
advisories are relevant to users of WSS4J:
</p>
<ul>
-<li><a href="http://cxf.apache.org/cve-2012-5575.html";>Note on
CVE-2012-5575</a> - XML Encryption backwards compatibility attack on Apache
CXF.</li>
-<li><a href="http://cxf.apache.org/note-on-cve-2011-2487.html";>Note on
CVE-2011-2487</a> - Bleichenbacher attack against distributed symmetric key in
WS-Security.</li>
-<li><a href="http://cxf.apache.org/note-on-cve-2011-1096.html";>Note on
CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding
attack.</li>
+<li><a href="https://cxf.apache.org/cve-2012-5575.html";>Note on
CVE-2012-5575</a> - XML Encryption backwards compatibility attack on Apache
CXF.</li>
+<li><a href="https://cxf.apache.org/note-on-cve-2011-2487.html";>Note on
CVE-2011-2487</a> - Bleichenbacher attack against distributed symmetric key in
WS-Security.</li>
+<li><a href="https://cxf.apache.org/note-on-cve-2011-1096.html";>Note on
CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding
attack.</li>
</ul>
</section>
