PT-2014-3443 · Apache · Apache Cxf

Published 2014-07-07 · Updated 2022-05-13 · CVE-2014-0035

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.13 Apache CXF versions 2.7.x prior to 2.7.10

Description The issue allows remote attackers to obtain sensitive information by sniffing the network, due to the transmission of the UsernameToken in cleartext when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken.

Recommendations For Apache CXF versions prior to 2.6.13, update to version 2.6.13 or later. For Apache CXF versions 2.7.x prior to 2.7.10, update to version 2.7.10 or later.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-310

Related Identifiers

CVE-2014-0035

GHSA-V45R-RJ5X-HPG2

RHSA-2014:0798

RHSA-2014:0799

Affected Products

Apache Cxf

References · 26

• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0799.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1351.html · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0035 · Security Note
• http://svn.apache.org/viewvc?view=revision&revision=1564724 · Patch
• https://osv.dev/vulnerability/GHSA-v45r-rj5x-hpg2 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0797.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0798.html · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/d249721708694cbb0f431c0658166ebdcb02ec15 · Note
• https://github.com/apache/cxf/commit/2d2fd1bf67dc2247b6aca31b83a571d865fad1c9 · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note