Vulners
Lucene search
Apache CXF Failed Element Verification(CVE-2012-2379)
| Reporter | Title | Published | Views | Family All 72 |
|---|---|---|---|---|
 | CVE-2012-2379 | 3 Jan 201301:00 | – | cve |
 | CVE-2012-2379 | 3 Jan 201301:00 | – | cvelist |
 | EUVD-2022-1980 | 3 Oct 202520:07 | – | euvd |
 | K15580: Apache CXF and JBoss vulnerabilities | 21 Feb 202319:49 | – | f5 |
| SOL15580 - Apache CXF and JBoss vulnerabilities | 11 Sep 201400:00 | – | f5 |
 | [SECURITY] Fedora 17 Update: cxf-2.4.9-2.fc17 | 12 Oct 201202:56 | – | fedora |
| [SECURITY] Fedora 18 Update: cxf-2.4.9-2.fc18 | 9 Oct 201200:29 | – | fedora |
 | Fedora 18 : cxf-2.4.9-2.fc18 (2012-15293) | 9 Oct 201200:00 | – | nessus |
| Fedora 17 : cxf-2.4.9-2.fc17 (2012-15329) | 12 Oct 201200:00 | – | nessus |
| RHEL 5 : JBoss EAP (RHSA-2012:1591) | 24 Jan 201300:00 | – | nessus |
10
CVE-2012-2379: Apache CXF does not verify that elements were signed or
encrypted by a particular Supporting Token.
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
This vulnerability affects all released versions of Apache CXF.
Description:
Apache CXF currently validates WS-SecurityPolicy SignedParts,
SignedElements,
EncryptedParts and EncryptedElements policies by checking to see if the
matching elements are signed or encrypted if they are included in the
request.
However, CXF does not ensure that the elements were signed or encrypted by
a particular token, if these policies are specified as children of a
Supporting Token. For example, the following policy requires that (the
private
key associated with) an X.509 Token sign the WS-Addressing "To" header. CXF
currently checks to see whether the header was signed, but not by a X.509
Token in particular:
<sp:SupportingToken>
<sp:X509Token sp:IncludeToken="...">...</sp:X509Token>
<sp:SignedParts>
<sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"
/>
</sp:SignedParts>
</sp:SupportingToken>
Note that this applies for both WS-SecurityPolicy 1.1 and 1.2 policies.
This has been fixed in revision:
http://svn.apache.org/viewvc?rev=1338219&view=rev
All released versions of CXF are affected.
Migration:
Users of CXF prior to 2.4.x should upgrade to either 2.4.8, 2.5.4, or 2.6.1.
CXF 2.4.5 to 2.4.7 users should upgrade to 2.4.8 as soon as possible.
CXF 2.5.1 to 2.5.3 users should upgrade to 2.5.4 as soon as possible.
CXF 2.6.0 users should upgrade to 2.6.1 as soon as possible.
References: http://cxf.apache.org/security-advisories.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAEBAgAGBQJP0HTcAAoJEGe/gLEK1TmDFVwH/Agv7RZZh8osal/xBWENZYKE
LrLK51XzYuASo6B6ezU69HsVmgLpbopl94Rhn7mbKdz0dFG417WbqftXz81PFc0N
UYIh8zNf/SAgm+7onRq9kawFqp28cbP2B1hkhT16q0BEMcB4bJ06YLR8J7VHcyxu
QW//mMuOszVvz1Pn6jlcaQryQ8tvwWPT1Li/L5QmZxmw/M4N9joOEtIp/3kJ+HhX
vW5BW9/9x4BSRU50dF13/viStUqUh5bZDDz1R6qbYm8IDU4F2eC8lc5KcGfBvbM7
uUmVTtsKsdlRo8d2gUL0iyCKp7n+2w9D19Y+gcUvsqKZGwQE/LuryDVNK4EFeBc=
=hkRS
-----END PGP SIGNATURE-----
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Jun 2012 00:00Current
EPSS0.03752