Описание
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
It was found that a flaw exists in JAX-RS clients using the streaming approach for XML signatures and encryption, where it does not enforce the message to be signed/encrypted. This could allow an attacker to subvert the integrity of the message.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | cxf | Not affected | ||
| Red Hat JBoss BRMS 5 | cxf | Not affected | ||
| Red Hat JBoss BRMS 6 | cxf | Not affected | ||
| Red Hat JBoss Data Grid 6 | cxf | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | cxf | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 5 | cxf | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | cxf | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | cxf | Not affected | ||
| Red Hat JBoss Fuse Service Works 6 | cxf | Not affected | ||
| Red Hat JBoss Operations Network 3 | cxf | Not affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
https://bugzilla.redhat.com/show_bug.cgi?id=1445327cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted
EPSS
Процентиль: 87%
0.03167
Низкий
6.5 Medium
CVSS3
Связанные уязвимости
CVSS3: 5.3
nvd
почти 9 лет назад
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
EPSS
Процентиль: 87%
0.03167
Низкий
6.5 Medium
CVSS3