PT-2014-3480 · Apache · Apache Cxf

Published 2014-05-08 · Updated 2022-05-13 · CVE-2014-0109

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.14 Apache CXF versions 2.7.x prior to 2.7.11

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending a large request with the Content-Type set to text/html to a SOAP endpoint. This triggers an error.

Recommendations For Apache CXF versions prior to 2.6.14, update to version 2.6.14 or later. For Apache CXF versions 2.7.x prior to 2.7.11, update to version 2.7.11 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2014-0109

GHSA-5WQF-H3R3-GXVH

RHSA-2014:0798

RHSA-2014:0799

Affected Products

Apache Cxf

References · 23

• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1351.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• https://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370740&api=v2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wqf-h3r3-gxvh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0109 · Security Note
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/a5f907b1da89453919218ba0bf70be0d8b6810c5 · Note
• https://github.com/apache/cxf/commit/6dd839afbb4d834ed668738bd89e7775c1cf2f9d · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note