Bug 1816175 (CVE-2019-12419)

Summary:	CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, cmoulliard, darran.lofthouse, dkreling, dosoudil, drieden, etirelli, extras-orphan, ggaughan, gmalinko, ibek, ikanello, iweiss, janstey, jawilson, jbalunas, jcantril, jochrist, jpallich, jperkins, jstastny, jwon, krathod, kverlaen, kwills, lef, lgao, lthon, mnovotny, msochure, msvehla, mszynkie, nwallace, paradhya, pdrozd, periklis, pgallagh, pjindal, pmackay, psotirop, puntogil, rguimara, rrajasek, rruss, rsvoboda, rsynek, sdaley, smaestri, sthorger, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cxf 3.3.4, cxf 3.2.11	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-18 15:15:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1816176
Bug Blocks:	1816177

Description Guilherme de Almeida Suckevicz 2020-03-23 13:52:36 UTC

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Reference:
http://cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc

Comment 1 Guilherme de Almeida Suckevicz 2020-03-23 13:53:11 UTC

Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1816176]

Comment 2 Jonathan Christison 2020-03-23 17:17:05 UTC

This vulnerability is out of security support scope for the following products:
 * Red Hat Jboss Fuse 6
 * Red Hat JBoss BPM Suite 6
 * Red Hat JBoss BRMS 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.

Comment 10 errata-xmlrpc 2020-05-18 10:28:03 UTC

This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067

Comment 11 Product Security DevOps Team 2020-05-18 15:15:41 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12419

Comment 12 errata-xmlrpc 2020-05-28 16:00:14 UTC

This issue has been addressed in the following products:

  EAP-CD 19 Tech Preview

Via RHSA-2020:2333 https://access.redhat.com/errata/RHSA-2020:2333