Описание
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
A flaw was found in Apache CXF. A remote attacker could exploit an LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server. This vulnerability allows the attacker to retrieve arbitrary certificates from the repository, leading to information disclosure.
Отчет
This is an Important information disclosure flaw in Apache CXF's XKMS server, allowing a remote attacker to retrieve arbitrary certificates via an LDAP injection vulnerability in the LDAP Certificate repository. This impact is considered Important due to the potential for unauthorized access to sensitive cryptographic material without requiring prior authentication, affecting the confidentiality of services utilizing the cxf-services-xkms-x509-repo-ldap component in Red Hat products.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | cxf-services-xkms-x509-repo-ldap | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | cxf-services-xkms-x509-repo-ldap | Not affected | ||
| Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | cxf-services-xkms-x509-repo-ldap | Fixed | RHSA-2026:37390 | 09.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Уязвимость сервиса XKMS (XML Key Management Specification) каркаса для веб-сервисов Apache CXF, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
7.5 High
CVSS3