CVE-2018-8038

CVE-2018-8038 affects Apache CXF Fediz prior to 1.4.4, where Document Type Declarations (DTDs) are not fully disabled when parsing Identity Provider responses (in application plugins) or in the IdP for certain XML parameters. Connected sources reinforce that the underlying issue is DTD handling a...

XML External Entity (XXE)

Apache CXF Fediz is vulnerable to XML External Entity XXE attacks. The library does not disable Document Type Declarations DTD, allowing a malicious user to conduct an XXE attack...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

Design/Logic Flaw

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

CVE-2018-8039

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty"java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol";'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old...

CVE-2018-8039

CVE-2018-8039: Apache CXF could allow a remote attacker to conduct a man‑in‑the‑middle attack due to TLS hostname verification not working when using com.sun.net.ssl. In CXF versions prior to 3.2.5 and 3.1.16 the exception is not properly propagated, leaving clients vulnerable. IBM/Oracle/Red Hat...

Hostname Verification Bypass

Apache CXF is vulnerable to hostname verification bypass. The vulnerability exists when CXF is used with the com.sun.net.ssl stack, leading to an error in TLS hostname verification which make CXF clients susceptible to man-in-the-middle attack...

Apache CXF CVE-2018-8039 TLS Hostname Verification Security Bypass Vulnerability

Description Apache CXF is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack. This may lead to other attacks. The following versions of product are vulnerable: Apache CXF 3.1.16...

Security Bulletin: Open Source Apache CXF Vulnerabilities affects IBM Spectrum LSF Explorer

Summary Open Source Apache CXF Vulnerabilities affects IBM Spectrum LSF Explorer. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to...

Security Bulletin: IBM Tivoli Netcool Impact is affected by a potential denial of service used by IBM WebSphere Application Server vulnerability (CVE-2017-12624)

Summary IBM Tivoli Netcool Impact has addressed the following vulnerability. There is a potential denial of service in Apache CXF that is used by IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a...

Security Bulletin: Open Source Apache CXF Vulnerablities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2017-12624)

Summary Vulnerabilities in Open Source Apache CXF affect IBM Tivoli Application Dependency Discovery Manager Vulnerability Details CVE-ID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could...

Security Bulletin: IBM Tivoli Network Manager IP Edition is affected by an Apache CXF vulnerability (CVE-2017-3156)

Summary Vulnerability has been addressed in the Apache CXF component of Tivoli Network Manager IP Edition. Vulnerability Details CVEID: CVE-2017-3156 DESCRIPTION: Apache CXF could provide weaker than expected security, caused by the failure to use the OAuth2 Hawk and JOSE MAC Validation code. A...

Security Bulletin: IBM TRIRIGA Application Platform Apache CXF Vulnerability (CVE-2017-5656)

Summary IBM TRIRIGA Application Platform is vulnerable to an exploit that can allow an attacker to bypass security restrictions. Vulnerability Details CVEID: CVE-2017-5656 DESCRIPTION: Apache CXF could allow a remote attacker to bypass security restrictions, caused by a flaw in the STSClient. By...

Security Bulletin: Security vulnerabilities have been identified in the Apache CXF component of IBM Tivoli Network Manager IP Edition (CVE-2016-6812, CVE-2016-8739)

Summary Security vulnerabilities have been addressed in the Apache CXF component of IBM Tivoli Network Manager IP Edition. Vulnerability Details CVEID: CVE-2016-6812 DESCRIPTION: Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the...

Security Bulletin: A security vulnerability has been identified in IBM Websphere Application Server shipped with IBM Security Identity Manager (CVE-2017-12624)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Security Identity Manager ISIM. Information about a security vulnerability affecting Apache CXF used by IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult th...

Security Bulletin: IBM Security Guardium is affected by Using Components with Known Vulnerabilities

Summary IBM Security Guardium is affected by Using Components with Known Vulnerabilities. IBM Security Guardium has fixed these vulnerabilities Vulnerability Details CVEID: CVE-2014-3584 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the processing of SAML tokens received...

Security Bulletin: IBM Security Guardium is affected by Using Components with Known vulnerabilities (multiple CVEs)

Summary IBM Security Guardium is affected by Using Components with Known vulnerabilities. IBM Security Guardium has fixed these vulnerabilities Vulnerability Details CVEID: CVE-2014-3584 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the processing of SAML tokens received...

Security Bulletin: A vulnerability in Apache CXF affects IBM InfoSphere Information Server

Summary A vulnerability in Apache CXF was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this...

Security Bulletin: Mulitiple security vulnerabilities in Apache CXF affects IBM InfoSphere Master Data Management (CVE-2016-6812 CVE-2016-8739 CVE-2017-5653 CVE-2017-5656 CVE-2017-3156)

Summary IBM Initiate Master Data Service is vulnerable to multiple Apache CXF issues and could allow remote attackers to steal a victim's cookie-based authentication credentials and read arbitrary files on the system. Vulnerability Details CVEID: CVE-2016-6812 DESCRIPTION: Apache CXF is vulnerabl...