GitHub Advisoryadvisory · Maven

GHSA-gw5j-77f9-v2g2 Loop with Unreachable Exit Condition in Apache CXF

MEDIUM Published 2022-05-13 Modified 2024-05-15 Official page ↗
Aliases
CVE-2014-3584
Ecosystem
Maven
Packages
org.apache.cxf:cxf-rt-frontend-jaxrs
Severity
Moderate
Weaknesses
CWE-835
Reviewed
2022-07-07

Affected packages

• Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.5.0, < 2.6.11 → fixed in 2.6.11 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 2.7.0, < 2.7.8 → fixed in 2.7.8 • Maven org.apache.cxf:cxf-rt-frontend-jaxrs: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

Related

Alias · CVE (1)

  • CVE-2014-3584 The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References