{"id":"CVE-2022-29249","aliases":["GHSA-67fj-6w6m-w5j8"],"url":"https://o3.security/vulnerability/CVE-2022-29249","summary":"Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ","details":"### Impact\nThis weakness allows the force decryption of locked text by hackers. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. Upgrading to 1.7 is advised.\n\n### Patches\nThe vulnerability has been patched in release 1.7.\n\n### Workarounds\nCurrently there is no way to fix the issue without upgrading.\n\n### References\n[CWE-327](https://cwe.mitre.org/data/definitions/327.html)\n[CWE-328](https://cwe.mitre.org/data/definitions/328.html)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [our issue tracker](http://github.com/JavaEZLib/JavaEZ/issues)\n* Email us at [javaezlib@gmail.com](mailto:javaezlib@gmail.com)\n","published":"2022-05-24T15:15:13Z","modified":"2026-10-28T02:30:43.385725167Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00718,"percentile":0.50734,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.github.javaezlib:JavaEZ","fixedVersion":"1.7"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29249.json"},{"type":"ADVISORY","url":"https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29249"},{"type":"PACKAGE","url":"https://github.com/JavaEZLib/JavaEZ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:43.385725167Z"}}