GitHub Advisoryadvisory · Maven

GHSA-58p8-9g59-q2hr Potential DOS attack due to unrestricted attachment count in messages

MEDIUM Published 2019-11-08 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-12406
Ecosystem
Maven
Packages
org.apache.cxf:cxf, org.apache.cxf:apache-cxf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2019-11-07

Affected packages

• Maven org.apache.cxf:cxf: < 3.2.11 → fixed in 3.2.11 • Maven org.apache.cxf:cxf: >= 3.3.0, < 3.3.4 → fixed in 3.3.4 • Maven org.apache.cxf:apache-cxf: < 3.2.11 → fixed in 3.2.11 • Maven org.apache.cxf:apache-cxf: >= 3.3.0, < 3.3.4 → fixed in 3.3.4

Description

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".

Related

Alias · CVE (1)

  • CVE-2019-12406 Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References