CVE-2012-5575 Vulnerability in maven package org.apache.cxf:cxf-bundle

Description

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

Remediation

References

http://cxf.apache.org/cve-2012-5575.html

http://rhn.redhat.com/errata/RHSA-2013-0833.html

http://rhn.redhat.com/errata/RHSA-2013-0834.html

http://rhn.redhat.com/errata/RHSA-2013-0839.html

http://rhn.redhat.com/errata/RHSA-2013-0873.html

http://rhn.redhat.com/errata/RHSA-2013-0874.html

http://rhn.redhat.com/errata/RHSA-2013-0875.html

http://rhn.redhat.com/errata/RHSA-2013-0876.html

http://rhn.redhat.com/errata/RHSA-2013-0943.html

http://rhn.redhat.com/errata/RHSA-2013-1028.html

http://rhn.redhat.com/errata/RHSA-2013-1143.html

http://rhn.redhat.com/errata/RHSA-2013-1437.html

http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/

http://www.securityfocus.com/bid/60043

https://bugzilla.redhat.com/show_bug.cgi?id=880443

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Related Vulnerabilities

CVE-2021-20328 Vulnerability in maven package org.mongodb:mongodb-driver-sync

CVE-2023-46660 Vulnerability in maven package org.jenkins-ci.plugins:zanata

CVE-2020-2188 Vulnerability in maven package org.jenkins-ci.plugins:ec2

CVE-2017-7678 Vulnerability in maven package org.apache.spark:spark-core_2.11

CVE-2017-15010 Vulnerability in maven package org.webjars.npm:tough-cookie

Severity

Critical

Classification

CWE-310