GitHub Advisoryadvisory · Maven

GHSA-7vgj-8mw4-hg8r Improper Input Validation in Apache CXF

MEDIUM Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-12624
Ecosystem
Maven
Packages
org.apache.cxf:cxf-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2022-07-01

Affected packages

• Maven org.apache.cxf:cxf-core: >= 3.2.0, < 3.2.1 → fixed in 3.2.1 • Maven org.apache.cxf:cxf-core: >= 3.1.0, < 3.1.14 → fixed in 3.1.14 • Maven org.apache.cxf:cxf-core: < 3.0.16 → fixed in 3.0.16

Description

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".

Related

Alias · CVE (1)

  • CVE-2017-12624 Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References