PT-2019-4676 · Apache · Apache Cxf
Published
2019-11-06
·
Updated
2021-06-17
·
CVE-2019-12406
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Apache CXF versions prior to 3.3.4 and 3.2.11
Description
The issue is related to an uncontrolled resource consumption in Apache CXF, which can be exploited by a remote attacker to cause a denial of service. This can be achieved by crafting a message with a large number of message attachments, exceeding the default limit. The default limit of 50 message attachments is enforced from versions 3.3.4 and 3.2.11 onwards and is configurable via the
attachment-max-count message property.Recommendations
For versions prior to 3.3.4 and 3.2.11, update to version 3.3.4 or 3.2.11 to enforce the default limit of 50 message attachments.
As a temporary workaround, consider configuring the
attachment-max-count message property to restrict the number of message attachments and minimize the risk of exploitation.Exploit
Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Cxf