Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
14 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Recommended action: Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.
Recommended action: Upgrade to 4.2.2, 4.1.7 or 3.6.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted. Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
Recommended action: Upgrade to 4.1.1, 4.0.7, 3.6.6 or 3.5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Recommended action: Upgrade to 4.0.6, 3.6.5 or 3.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
Recommended action: Upgrade to 3.5.5 or 3.4.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Recommended action: Upgrade to 3.5.5 or 3.4.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
Recommended action: Upgrade to 2.7.11 or 2.6.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Recommended action: Upgrade to 2.7.10 or 2.6.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
Recommended action: Upgrade to 3.1.9 or 3.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
Recommended action: Upgrade to 2.7.11 or 2.6.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.
Recommended action: Upgrade to 3.1.9 or 3.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
Recommended action: Upgrade to 3.2.1, 3.1.14 or 3.0.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
Recommended action: Upgrade to 3.1.11 or 3.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Recommended action: Upgrade to 3.1.11 or 3.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.