GitHub Advisoryadvisory · Maven

GHSA-2g99-c67p-56hm XML Signature/Encryption Not Validated in Apache CXF

HIGH Published 2022-05-13 Modified 2022-07-13 Official page ↗
Aliases
CVE-2012-2379
Ecosystem
Maven
Packages
org.apache.cxf:cxf
Severity
High
Reviewed
2022-07-13

Affected packages

• Maven org.apache.cxf:cxf: >= 2.4.0, < 2.4.8 → fixed in 2.4.8 • Maven org.apache.cxf:cxf: >= 2.5.0, < 2.5.4 → fixed in 2.5.4 • Maven org.apache.cxf:cxf: >= 2.6.0, < 2.6.1 → fixed in 2.6.1

Description

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

Related

Alias · CVE (1)

  • CVE-2012-2379 Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1… vulnerability

References