Bug 2387221 (CVE-2025-48913)

Summary:	CVE-2025-48913 org.apache.cxf/cxf: CXF JMS Code Execution Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, brian.stansberry, darran.lofthouse, dkreling, dosoudil, istudens, ivassile, iweiss, mosmerov, msochure, msvehla, nwallace, pesilva, pjindal, pmackay, rstancel, smaestri, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in org.apache.cxf/cxf, where untrusted users can configure JMS to allow the specification of RMI or LDAP URLs, possibly leading to code execution. This vulnerability allows an attacker to provide malicious protocol URLs during JMS configuration.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-08-08 10:01:17 UTC

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.  This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.

Comment 6 errata-xmlrpc 2025-10-02 17:34:37 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0.9

Via RHSA-2025:17318 https://access.redhat.com/errata/RHSA-2025:17318

Comment 7 errata-xmlrpc 2025-10-02 17:35:52 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Via RHSA-2025:17317 https://access.redhat.com/errata/RHSA-2025:17317

Comment 11 errata-xmlrpc 2026-03-18 13:15:11 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Via RHSA-2026:4915 https://access.redhat.com/errata/RHSA-2026:4915

Comment 12 errata-xmlrpc 2026-03-18 13:16:23 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8

Via RHSA-2026:4916 https://access.redhat.com/errata/RHSA-2026:4916

Comment 13 errata-xmlrpc 2026-03-18 13:17:13 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Via RHSA-2026:4917 https://access.redhat.com/errata/RHSA-2026:4917

Comment 14 errata-xmlrpc 2026-03-18 13:55:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4

Via RHSA-2026:4924 https://access.redhat.com/errata/RHSA-2026:4924

Comment 15 errata-xmlrpc 2026-03-30 01:09:30 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2026:6012 https://access.redhat.com/errata/RHSA-2026:6012

Comment 16 errata-xmlrpc 2026-03-30 01:20:48 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Via RHSA-2026:6011 https://access.redhat.com/errata/RHSA-2026:6011