CVE-2022-29161

Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA. Administrators are advised to upgrade their XWiki installation to one of the patched versions. If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in 26728f3 and re-compiling the module.

Categories

5.4
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.36%
Vendor Advisory xwiki.org
Affected: xwiki xwiki-platform
Published at:
Updated at:

References

Link Tags
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h8v5-p258-pqf4 third party advisory
https://github.com/xwiki/xwiki-platform/commit/26728f3f23658288683667a5182a916c7ecefc52 third party advisory patch
https://jira.xwiki.org/browse/XWIKI-19676 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-29161?
CVE-2022-29161 has been scored as a medium severity vulnerability.
How to fix CVE-2022-29161?
To fix CVE-2022-29161, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-29161 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-29161 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-29161?
CVE-2022-29161 affects xwiki xwiki-platform.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.