Bug 1445327 (CVE-2017-5653)

Summary: CVE-2017-5653 cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, aileenc, alazarot, anstephe, apmukher, bbaranow, bmaxwell, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, dimitris, dosoudil, drieden, etirelli, fgavrilo, gvarsami, huwang, ibek, jawilson, jcoleman, jolee, jondruse, jshepherd, kconner, krathod, kverlaen, ldimaggi, lgao, loleary, lpetrovi, mbaluch, mwinkler, myarboro, nwallace, paradhya, pdrozd, pgier, pjurak, ppalaga, psakar, pslavice, psotirop, puntogil, rnetuka, rrajasek, rstancel, rsvoboda, rsynek, rwagner, rzhang, sdaley, spinder, sstavrev, sthorger, tcunning, theute, tiwillia, tkirby, twalsh, vhalbert, vtunka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: cxf 3.1.11, cxf 3.0.13 Doc Type: If docs needed, set a value
Doc Text:
It was found that a flaw exists in JAX-RS clients using the streaming approach for XML signatures and encryption, where it does not enforce the message to be signed/encrypted. This could allow an attacker to subvert the integrity of the message.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:11:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1445335    
Bug Blocks: 1445347    

Description Andrej Nemec 2017-04-25 13:40:58 UTC
Apache CXF supports the ability to use XML Signature and encryption to secure
JAX-RS services. Two different implementations are available, a DOM based 
approach that works on a model of the message in memory before applying
security, and a streaming based implementation that is a useful alternative
for larger messages.

There is a bug in validating messages for JAX-RS clients using the streaming
approach, where it will not enforce that the message is signed and/or
encrypted. An exception is thrown in these cases but not properly propagated
to the client code. The bug does not apply for the DOM clients and it does not
apply for the streaming server side case.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc

Upstream patch:

https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=fade9b81dabe27f864ca38e7b40f28fb44d6f165

Comment 1 Andrej Nemec 2017-04-25 13:46:25 UTC
Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1445335]

Comment 3 errata-xmlrpc 2017-08-10 23:04:57 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2017:1832