CVE-2017-5653: Improper Certificate Validation in Apache CXF
Summary
CVE-2017-5653: Improper Certificate Validation in Apache CXF. Affects org.apache.cxf:cxf-core across 2 version ranges.
< 3.0.13
>= 3.1.0, < 3.1.11
Fixed in 3.0.13 or 3.1.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache CXF is an open-source services framework that helps build and develop web services using standard protocols such as SOAP and REST. It provides a comprehensive set of tools and libraries for creating and consuming web services. The vulnerability identified as CVE-2017-5653 affects the JAX-RS XML Security streaming clients in Apache CXF versions before 3.1.11 and 3.0.13. These versions do not properly validate the service response, allowing remote attackers to spoof servers.
Vulnerability Detail
The vulnerability arises from the lack of validation in the JAX-RS XML Security streaming clients. As a result, an attacker can send a malicious response that appears to be from a legitimate server, leading to potential security breaches. This can enable various attacks, such as man-in-the-middle attacks or the interception of sensitive data. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.133.0.13 -
>= 3.1.0, < 3.1.113.1.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apache CXF versions before 3.1.11 and 3.0.13 allows remote attackers to spoof servers, potentially leading to security breaches. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
Apache CXF is an open-source services framework for building and developing web services using standard protocols such as SOAP and REST.
The vulnerability allows remote attackers to spoof servers, potentially leading to security breaches and the interception of sensitive data.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to Apache CXF version 3.1.11 or later if using version 3.1.x, or version 3.0.13 or later if using version 3.0.x.
There is no specific workaround provided for this vulnerability. It is advised to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
