Bug 1816175 (CVE-2019-12419) - CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId
Summary: CVE-2019-12419 cxf: OpenId Connect token service does not properly validate t...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-12419
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1816176
Blocks: Embargoed1816177
TreeView+ depends on / blocked
 
Reported: 2020-03-23 13:52 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-09-08 09:08 UTC (History)
64 users (show)

Fixed In Version: cxf 3.3.4, cxf 3.2.11
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-05-18 15:15:41 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2067 0 None None None 2020-05-18 10:28:12 UTC
Red Hat Product Errata RHSA-2020:2333 0 None None None 2020-05-28 16:00:18 UTC

Description Guilherme de Almeida Suckevicz 2020-03-23 13:52:36 UTC 
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

Reference:
http://cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc
Comment 1 Guilherme de Almeida Suckevicz 2020-03-23 13:53:11 UTC 
Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1816176]
Comment 2 Jonathan Christison 2020-03-23 17:17:05 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat Jboss Fuse 6
 * Red Hat JBoss BPM Suite 6
 * Red Hat JBoss BRMS 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
Comment 10 errata-xmlrpc 2020-05-18 10:28:03 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
Comment 11 Product Security DevOps Team 2020-05-18 15:15:41 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-12419
Comment 12 errata-xmlrpc 2020-05-28 16:00:14 UTC 
This issue has been addressed in the following products:

  EAP-CD 19 Tech Preview

Via RHSA-2020:2333 https://access.redhat.com/errata/RHSA-2020:2333
Note You need to log in before you can comment on or make changes to this bug.