GitHub Advisoryadvisory · Maven

GHSA-hgg6-8x62-m9gf Improper Certificate Validation in Apache CXF

MEDIUM Published 2022-05-13 Modified 2023-12-21 Official page ↗
Aliases
CVE-2017-5653
Ecosystem
Maven
Packages
org.apache.cxf:cxf-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-295
Reviewed
2022-07-01

Affected packages

• Maven org.apache.cxf:cxf-core: >= 3.1.0, < 3.1.11 → fixed in 3.1.11 • Maven org.apache.cxf:cxf-core: < 3.0.13 → fixed in 3.0.13

Description

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.

Related

Alias · CVE (1)

  • CVE-2017-5653 JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References