PT-2021-18741 · Apache · Apache Cxf

Published 2021-06-16 · Updated 2022-04-25 · CVE-2021-30468

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.4.4 Apache CXF versions prior to 3.3.11

Description A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely.

Recommendations For Apache CXF versions prior to 3.4.4, update to version 3.4.4 or later. For Apache CXF versions prior to 3.3.11, update to version 3.3.11 or later.

Fix

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

CVE-2021-30468

GHSA-G23V-P5JQ-JVH4

Affected Products

Apache Cxf

References · 32

• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• http://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30468 · Security Note
• https://osv.dev/vulnerability/GHSA-g23v-p5jq-jvh4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30468 · Vendor Advisory
• https://lists.apache.org/thread.html/r3f46ae38e4a6e80c069cdb320e0ce831b0a21a12ef0cc92c0943f34a%40%3Ccommits.tomee.apache.org%3E · Note
• https://lists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737%40%3Ccommits.tomee.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422@%3Ccommits.tomee.apache.org%3E · Note
• https://t.me/cvenotify/24487 · Telegram Post
• http://openwall.com/lists/oss-security/2021/06/16/2 · Note
• https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422%40%3Ccommits.tomee.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459@%3Cdev.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cdev.cxf.apache.org%3E · Note