PT-2014-3481 · Apache · Apache Cxf

Published 2014-05-08 · Updated 2022-05-13 · CVE-2014-0110

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.14 Apache CXF versions 2.7.x prior to 2.7.11

Description The issue allows remote attackers to cause a denial of service, specifically /tmp disk consumption, by sending a large invalid SOAP message.

Recommendations For Apache CXF versions prior to 2.6.14, update to version 2.6.14 or later. For Apache CXF versions 2.7.x prior to 2.7.11, update to version 2.7.11 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

CVE-2014-0110

GHSA-5XF9-3V63-WW6F

RHSA-2014:0798

RHSA-2014:0799

Affected Products

Apache Cxf

References · 24

• http://rhn.redhat.com/errata/RHSA-2015-0850.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0851.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1351.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0110 · Security Note
• https://osv.dev/vulnerability/GHSA-5xf9-3v63-ww6f · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378628&api=v2 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/35cd29270b77b489cb23552637d66d47ce480f4c · Note
• https://github.com/apache/cxf/commit/643b1bc7320ca90c3e078e50509f9a30a0ab45be · Note
• https://github.com/apache/cxf/commit/8f4799b5bc5ed0fe62d6e018c45d960e3652373e · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• http://securitytracker.com/id/1030202 · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note