GHSA-7v5v-9v8r-w864

Source

https://github.com/advisories/GHSA-7v5v-9v8r-w864

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7v5v-9v8r-w864/GHSA-7v5v-9v8r-w864.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7v5v-9v8r-w864

Aliases

CVE-2012-5575

Published

2022-05-13T01:09:21Z

Modified

2024-12-08T05:38:53.892249Z

Summary

Inadequate Encryption Strength in Apache CXF

Details

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

Database specific

{
    "nvd_published_at": "2013-08-19T23:55:00Z",
    "cwe_ids": [
        "CWE-326"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-13T15:29:33Z"
}

References

Affected packages

Maven / org.apache.cxf:cxf-rt-transports-http

Package

Name: org.apache.cxf:cxf-rt-transports-http; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-rt-transports-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.10

Affected versions

2.*

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.5.8

2.5.9

Maven / org.apache.cxf:cxf-rt-transports-http

Package

Name: org.apache.cxf:cxf-rt-transports-http; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-rt-transports-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.0

Fixed

2.6.7

Affected versions

2.*

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

Maven / org.apache.cxf:cxf-rt-transports-http

Package

Name: org.apache.cxf:cxf-rt-transports-http; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-rt-transports-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.7.0

Fixed

2.7.4

Affected versions

2.*

2.7.0

2.7.1

2.7.2

2.7.3