CVE-2014-0110: Uncontrolled Resource Consumption in Apache CXF
Summary
CVE-2014-0110: Uncontrolled Resource Consumption in Apache CXF. Affects org.apache.cxf:cxf-core across 2 version ranges.
< 2.6.14
>= 2.7.0, < 2.7.11
Fixed in 2.6.14 or 2.7.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source web services framework that allows developers to build and deploy SOAP and RESTful web services. It provides a comprehensive set of tools and libraries for developing web services using Java. The Apache CXF Core module (org.apache.cxf:cxf-core) is a key component of the Apache CXF framework, providing the core functionality for handling SOAP messages and processing web service requests and responses.
Vulnerability Detail
The vulnerability identified as CVE-2014-0110 affects Apache CXF versions before 2.6.14 and 2.7.x before 2.7.11. It allows remote attackers to cause a denial of service (disk consumption) by sending a large invalid SOAP message. This vulnerability can be exploited to exhaust the available disk space on the target system, leading to a denial of service condition. The issue arises from the improper handling of large invalid SOAP messages, which results in uncontrolled resource consumption.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.142.6.14 -
>= 2.7.0, < 2.7.112.7.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Apache CXF.
Conclusion
The vulnerability in Apache CXF allows remote attackers to cause a denial of service by sending a large invalid SOAP message, resulting in uncontrolled resource consumption. To mitigate this issue, it is recommended to upgrade to the patched versions of Apache CXF. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
Apache CXF is an open-source web services framework that allows developers to build and deploy SOAP and RESTful web services using Java.
The vulnerability can be exploited by remote attackers to cause a denial of service by consuming excessive disk space on the target system.
To fix this vulnerability, upgrade to Apache CXF version 2.6.14 or later (for 2.6.x branch) or version 2.7.11 or later (for 2.7.x branch).
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions of Apache CXF.
You can find more information about this vulnerability in the CVE-2014-0110 advisory and the Apache CXF documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
