Remote Web Service Operation

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web service operations by sending a header with a SOAP Action String that is inconsistent with the message body...

Authentication Bypass In The SecurityTokenService

The SecurityTokenService STS in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token...

XML Encryption Backwards Compatibility Attack

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

Security Bulletin: Potential MITM attack in Apache CXF used by WebSphere Application Server affects IBM Operations Analytics - Log Analysis (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by WebSphere Application Server CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not wor...

Security Bulletin: Denial of Service in Apache CXF used by WebSphere Application Server affect IBM Operations Analytics - Log Analysis (CVE-2017-12624)

Summary There is a potential denial of service in Apache CXF that is used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could...

Security Bulletin: Asset Analyzer (RAA) is affected by an Apache CXF vulnerability

Summary Rational Asset Analyzer RAA has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl...

Security Bulletin: Potential MITM attack in Apache CXF used by IBM Event Streams (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by IBM Event Streams CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly...

apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in...

Security Bulletin: Potential MITM attack in Apache CXF used by IBM® WebSphere™ Application Server Liberty affects IBM® SPSS Analytic Server (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by IBM WebSphere Application Server Liberty that affects SPSS Analytic Server. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS...

Security Bulletin: Multiple vulnerabilities affect IBM Voice Gateway

Summary Multiple vulnerabilities affect IBM Voice Gateway Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not work correctly with com.sun.net.ssl interface. An attacker could...

Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale

Summary There is a vulnerability in IBM WebSphere Application Server, used by IBM Spectrum Scale. This issue allow a remote attacker to conduct a man-in-the-middle attack. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-midd...

apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in...

Important: Red Hat Security Advisory: Red Hat Fuse 7.2 security update

An update is now available for Red Hat Fuse. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Security Bulletin: Denial of Service in Apache CXF used by WebSphere Application Server shipped with Jazz for Service Management (CVE-2017-12624)

Summary There is a potential denial of service in Apache CXF that is used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could...

Security Bulletin: Potential MITM attack in Apache CXF used by WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by WebSphere Application Server CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not wor...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Cloud

Summary There are potential information disclosure vulnerabilities in Liberty for Java for IBM Cloud. There is a potential man-in-the-middle attack in Apache CXF used by Liberty for Java for IBM Cloud. There is a potential code execution vulnerability in OpenID connect in WebSphere Application...

Security Bulletin: Multiple Vulnerabilities in IBM Cognos Analytics

Summary This bulletin addresses several security vulnerabilities that are fixed in IBM Cognos Analytics 11.0.13.0. Multiple Open Source OpenSSL vulnerabilities affect IBM Cognos Analytics. IBM Cognos Analytics consumes IBM GSKit. Multiple vulnerabilities have been addressed in IBM GSKit. IBM Cogn...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server in IBM Cloud

Summary There is a potential man-in-the-middle attack in Apache CXF used by WebSphere Application Server. There is a potential directory traversal vulnerability in the Admin Console for WebSphere Application Server. There is a potential bypass security vulnerability in the expression language...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2018-8039)

Summary IBM WebSphere Application Server is shipped with IBM Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Consult the security bulletin, Security Bulletin:...

Security Bulletin: Open Source Apache CXF Vulnerabilities

Summary Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to cause the AX-WS and JAX-RS services stop responding. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is...