Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

GHSA-38x2-fp9m-87mx | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-38x2-fp9m-87mx

GHSA-38x2-fp9m-87mx

UNKNOWN

Improper Input Validation in Apache CXF

Published May 13, 2022

Modified 2 years ago

Fix available

Details

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

Affected Packages

org.apache.cxf:cxf-rt-ws-security

Maven

Fixed in:

2.6.12

org.apache.cxf:cxf-rt-ws-security

Maven

Fixed in:

2.7.9

References

WEB

http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc

WEB

http://rhn.redhat.com/errata/RHSA-2014-0797.html

WEB

http://rhn.redhat.com/errata/RHSA-2014-0798.html

WEB

http://rhn.redhat.com/errata/RHSA-2014-0799.html

WEB

http://rhn.redhat.com/errata/RHSA-2014-1351.html

WEB

http://rhn.redhat.com/errata/RHSA-2015-0850.html

WEB

http://rhn.redhat.com/errata/RHSA-2015-0851.html

WEB

http://svn.apache.org/viewvc?view=revision&revision=1551228

ADVISORY

https://github.com/advisories/GHSA-38x2-fp9m-87mx

WEB

https://github.com/apache/cxf

WEB

https://github.com/apache/cxf/commit/b4b9a010bb23059251400455afabddee15b46127

WEB

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E

WEB

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E

WEB

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E

WEB

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E

WEB

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E

WEB

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2014-0034

Aliases

CVE-2014-0034

Ecosystems

Maven

Timeline

PublishedMay 13, 2022

ModifiedDec 21, 2023