PT-2014-5406 · Apache · Apache Cxf

Publicado 2014-10-30 · Atualizado 2022-05-13 · CVE-2014-3584

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions 2.6.10 and earlier, 2.7.x before 2.7.8, 3.0.x before 3.0.1

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This can be achieved by sending a crafted SAML token in the authorization header of a request to a JAX-RS service.

Recommendations For Apache CXF versions 2.6.10 and earlier, update to version 2.6.11 or later. For Apache CXF versions 2.7.x before 2.7.8, update to version 2.7.8 or later. For Apache CXF versions 3.0.x before 3.0.1, update to version 3.0.1 or later.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-399

CWE-835

Identificadores relacionados

CVE-2014-3584

GHSA-GW5J-77F9-V2G2

MGASA-2014-0557

Produtos afetados

Apache Cxf

Referências · 29

• https://github.com/apache/cxf · Nota
• https://github.com/apache/cxf/commit/0b3894f57388b9955f2c33b2295223f2835cd7b3 · Nota
• https://github.com/apache/cxf/commit/47b127dbdb4a10d282be92f2ebbe646f8cf6b03e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3584 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97753 · Nota
• http://securityfocus.com/bid/70738 · Nota
• http://cxf.apache.org/security-advisories.data/CVE-2014-3584.txt.asc · Aviso do Fabricante
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E · Nota
• https://issues.apache.org/jira/browse/CXF-5390 · Nota
• http://secunia.com/advisories/61909 · Nota
• https://advisories.mageia.org/MGASA-2014-0557.html · Nota de Segurança
• http://seclists.org/oss-sec/2014/q4/437 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0557 · Aviso do Fabricante
• http://cxf.apache.org/security-advisories.data/CVE-2014-3577.txt.asc · Nota
• https://bugs.mageia.org/show_bug.cgi?id=14363 · Nota