PT-2017-6822 · Apache · Apache Cxf Fediz

Colm O Heigeartaigh · Published 2017-06-07 · Updated 2021-06-16 · CVE-2015-5175

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF Fediz versions 1.1.0 through 1.1.3 Apache CXF Fediz versions 1.2.x prior to 1.2.1

Description The issue allows remote attackers to cause a denial of service. This can be achieved through application plugins in Apache CXF Fediz.

Recommendations For Apache CXF Fediz versions 1.1.0 through 1.1.2, update to version 1.1.3 to resolve the issue. For Apache CXF Fediz versions 1.2.x prior to 1.2.1, update to version 1.2.1 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-5175

GHSA-3357-829X-M9PR

Affected Products

Apache Cxf Fediz

References · 23

• https://osv.dev/vulnerability/GHSA-3357-829x-m9pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5175 · Security Note
• https://cxf.apache.org/security-advisories.data/CVE-2015-5175.txt.asc?version=1&modificationDate=1440598018000&api=v2 · Vendor Advisory
• https://github.com/apache/cxf-fediz/commit/f65c961ea31e3c1851daba8e7e49fc37bbf77b19 · Note
• https://mail-archives.apache.org/mod_mbox/cxf-dev/201508.mbox/%3CCAB8XdGAx=VL_uepDSecE2h8ggTD4kpagXnyfegVjt7Axi_Ossw%40mail.gmail.com%3E · Note
• http://securityfocus.com/bid/76486 · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://github.com/advisories/GHSA-3357-829x-m9pr · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://mail-archives.apache.org/mod_mbox/cxf-dev/201508.mbox/%3CCAB8XdGAx=[e-mail]%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Note