CVE-2019-12406: Potential DOS attack due to unrestricted attachment count in messages in Apache CXF
Summary
CVE-2019-12406: Potential DOS attack due to unrestricted attachment count in messages. Affects org.apache.cxf:cxf across 2 version ranges.
< 3.2.11
>= 3.3.0, < 3.3.4
Fixed in 3.2.11 or 3.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source, fully featured web services framework that helps users build and develop services using frontend programming APIs. It provides a standards-based programming model and supports various protocols such as SOAP, XML/HTTP, RESTful HTTP, and more. This vulnerability affects versions before 3.3.4 and 3.2.11 of Apache CXF, where the number of message attachments in a given message is not restricted. This opens up the possibility of a denial of service (DOS) attack, where a malicious user can create a message with an excessive number of attachments, potentially overwhelming the system and causing it to become unresponsive.
Vulnerability Detail
The vulnerability arises from the lack of restriction on the number of message attachments in Apache CXF. Prior to the 3.3.4 and 3.2.11 releases, there was no default limit on the attachment count. This allowed an attacker to craft a message with a large number of attachments, potentially leading to a DOS attack. To mitigate this issue, the 3.3.4 and 3.2.11 releases enforce a default limit of 50 message attachments, which can also be configured using the message property 'attachment-max-count'. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2019-12406.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.113.2.11 -
>= 3.3.0, < 3.3.43.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed versions of Apache CXF as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability in Apache CXF before versions 3.3.4 and 3.2.11 allows for a potential denial of service (DOS) attack by exploiting the lack of restriction on the number of message attachments. To mitigate this issue, it is crucial to upgrade to the fixed versions of Apache CXF and configure the 'attachment-max-count' property appropriately. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf:cxf →
FAQ
Apache CXF is an open-source web services framework that allows users to build and develop services using various protocols.
This vulnerability can potentially lead to a denial of service (DOS) attack by overwhelming the system with a large number of message attachments.
To fix this vulnerability, upgrade to Apache CXF version 3.3.4 or 3.2.11, which enforce a default limit on the number of message attachments.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed versions of Apache CXF.
The CVE identifier for this vulnerability is CVE-2019-12406.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf.
