CVE-2012-2379: XML Signature/Encryption Not Validated in Apache CXF
Summary
CVE-2012-2379: XML Signature/Encryption Not Validated in Apache CXF. Affects org.apache.cxf:cxf across 3 version ranges.
>= 2.4.0, < 2.4.8
>= 2.5.0, < 2.5.4
>= 2.6.0, < 2.6.1
Fixed in 2.4.8, 2.5.4 or 2.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that provides a comprehensive set of tools and libraries for building SOAP and RESTful services. It is widely used in Java-based applications to implement web services functionality. This vulnerability affects Apache CXF versions 2.4.x, 2.5.x, and 2.6.x. The vulnerability arises when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, and Apache CXF fails to properly ensure that an XML element is signed or encrypted. This vulnerability can have unspecified impact and can be exploited through various attack vectors.
Vulnerability Detail
The vulnerability in Apache CXF allows an attacker to bypass XML signature and encryption validation, potentially leading to unauthorized access, data tampering, or other security breaches. By exploiting this vulnerability, an attacker can manipulate the XML elements that are supposed to be signed or encrypted, bypassing the intended security measures. This can result in the compromise of sensitive data, unauthorized access to protected resources, or the injection of malicious content into the communication flow.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.4.0, < 2.4.82.4.8 -
>= 2.5.0, < 2.5.42.5.4 -
>= 2.6.0, < 2.6.12.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Apache CXF.
Conclusion
The XML Signature/Encryption validation vulnerability in Apache CXF can have serious security implications, potentially leading to unauthorized access or data tampering. It is crucial for developers to upgrade to the fixed versions of Apache CXF or apply the official patches to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework that provides tools and libraries for building SOAP and RESTful services in Java-based applications.
This vulnerability affects Apache CXF versions 2.4.x, 2.5.x, and 2.6.x.
The impact of this vulnerability is unspecified, but it can potentially lead to unauthorized access, data tampering, or other security breaches.
To fix this vulnerability, it is recommended to upgrade to Apache CXF versions 2.4.8, 2.5.4, or 2.6.1, which include the necessary patches to address the issue.
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions of Apache CXF.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
