cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks

It was found that Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMAC...

Design/Logic Flaw

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

Code injection

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2016-8739

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

CVE-2016-8739

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2016-8739

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

CVE-2016-8739

CVE-2016-8739 affects the CXF JAX-RS Abdera-based Atom readers, which expand XML entities by default, enabling an XML External Entity (XXE) risk. Affected: Apache CXF JAX-RS before 3.0.12 and before 3.1.x before 3.1.9. Impact per sources: potential read of arbitrary files via crafted XML. Remedia...

CVE-2016-8739

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

CVE-2017-3156

The CVE-2017-3156 issue concerns the OAuth2 Hawk and JOSE MAC validation in Apache CXF. The connected advisories identify a root cause: the MAC signature comparison is not performed in constant time, creating exposure to timing attacks. Affected CXF versions are before 3.0.13 and before 3.1.10 in...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Design/Logic Flaw

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

CVE-2016-6812 affects the HTTP transport module of Apache CXF. The issue arises when the service list page is generated using the calculated base URL; if the request URL contains unexpected matrix parameters, they may be echoed back in the service endpoint URLs, causing a reflected cross‑site scr...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

PT-2017-9774

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.12 Apache CXF versions 3.1.x prior to 3.1.9 Description The issue concerns the JAX-RS module in Apache CXF, which provides Atom JAX-RS MessageBodyReaders that utilize the Apache Abdera Parser. This parser expan...

PT-2017-9025

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.12 Apache CXF versions 3.1.x prior to 3.1.9 Description The issue concerns the HTTP transport module, which generates an HTML page listing available service endpoints. This page includes the names and absolute...

CVE-2016-8739: Improper Restriction of XML External Entity Reference

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...