PT-2017-16647 · Apache · Apache Cxf

Published 2017-04-18 · Updated 2022-05-13 · CVE-2017-5653

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.1.11 Apache CXF versions prior to 3.0.13

Description The issue concerns the JAX-RS XML Security streaming clients in Apache CXF, where the service response is not validated for a signature or encryption. This allows remote attackers to spoof servers.

Recommendations For versions prior to 3.1.11, update to version 3.1.11 or later. For versions prior to 3.0.13, update to version 3.0.13 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-5653

GHSA-HGG6-8X62-M9GF

Affected Products

Apache Cxf

References · 21

• https://access.redhat.com/errata/RHSA-2017:1832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5653 · Security Note
• https://osv.dev/vulnerability/GHSA-hgg6-8x62-m9gf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5653 · Vendor Advisory
• http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1&modificationDate=1492515074710&api=v2 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/20d0fa3ec41c16c52b74dcc006f9d9ea212fa80f · Note
• http://securityfocus.com/bid/97968 · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Note