CVE-2017-12624: Improper Input Validation in Apache CXF
Summary
CVE-2017-12624: Improper Input Validation in Apache CXF. Affects org.apache.cxf:cxf-core across 3 version ranges.
< 3.0.16
>= 3.1.0, < 3.1.14
>= 3.2.0, < 3.2.1
Fixed in 3.0.16, 3.1.14 or 3.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is a popular open-source framework for building web services using Java. It supports sending and receiving attachments via the JAX-WS and JAX-RS specifications. This vulnerability affects both JAX-WS and JAX-RS services in Apache CXF. The vulnerability allows an attacker to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. The issue was first identified in Apache CXF version 3.2.0 and was fixed in version 3.2.1. The vulnerability is rated as moderate in severity with a CVSS score of 5.5.
Vulnerability Detail
The vulnerability arises from improper input validation of message attachment headers in Apache CXF. An attacker can exploit this by crafting a malicious message attachment header that exceeds 300 characters. When the vulnerable CXF web service provider receives such a message, it may consume excessive resources and become unresponsive, leading to a DoS condition. The impact of this vulnerability is limited to the availability of the affected web service. The vulnerability has been assigned the identifier CVE-2017-12624.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.163.0.16 -
>= 3.1.0, < 3.1.143.1.14 -
>= 3.2.0, < 3.2.13.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a patched version of Apache CXF.
Conclusion
The vulnerability in Apache CXF allows for a Denial of Service (DoS) attack on web service providers. It is recommended to upgrade to Apache CXF version 3.2.1 or later to mitigate this vulnerability. No known workarounds exist. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
Apache CXF is an open-source framework for building web services using Java. It provides support for various web service standards and protocols.
JAX-WS (Java API for XML Web Services) is a Java API for creating and consuming SOAP-based web services.
JAX-RS (Java API for RESTful Web Services) is a Java API for creating and consuming RESTful web services.
A Denial of Service (DoS) attack is an attempt to make a computer or network resource unavailable to its intended users by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
This vulnerability is rated as moderate in severity with a CVSS score of 5.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
