PT-2024-5101 · Apache · Apache Cxf

Colm O Heigeartaigh · Published 2024-07-18 · Updated 2024-08-07 · CVE-2024-41172

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 3.6.3 and earlier, 4.0.4 and earlier

Description: The issue is related to a memory leak in the Apache CXF HTTP client conduit, which can prevent HTTPClient instances from being garbage collected. This can cause memory consumption to increase over time, potentially leading to the application running out of memory. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. For versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HTTP client conduit to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-789

CWE-401

Related Identifiers

BDU:2024-05628

CVE-2024-41172

GHSA-4MGG-FQFQ-64HG

RHSA-2024:8823

RHSA-2024:8824

Affected Products

Apache Cxf

References · 13

• https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05628 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41172 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41172 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4mgg-fqfq-64hg · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://seclists.org/oss-sec/2024/q3/92 · Note
• https://t.me/cvedetector/1206 · Telegram Post
• https://vuldb.com/?id.271917 · Note
• http://openwall.com/lists/oss-security/2024/07/18/4 · Note
• https://t.me/cvenotify/86711 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240808-0008 · Note