Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 889008 - (CVE-2012-5633) CVE-2012-5633 jbossws-cxf, apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor
CVE-2012-5633 jbossws-cxf, apache-cxf: Bypass of security constraints on WS e...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20130208,repo...
: Security
Depends On: 873846 896337 896338 896347 901329 909247 909248 915386
Blocks: 889009 917476 917477
  Show dependency tree / graph
 
Reported: 2012-12-19 21:15 EST by David Jorm
Modified: 2014-10-20 20:04 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-15 17:29:28 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0256 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 5.2.0 security update 2013-02-13 18:50:39 EST
Red Hat Product Errata RHSA-2013:0257 normal SHIPPED_LIVE Important: JBoss Enterprise Application Platform 5.2.0 security update 2013-02-13 19:01:01 EST
Red Hat Product Errata RHSA-2013:0258 normal SHIPPED_LIVE Important: JBoss Enterprise Web Platform 5.2.0 security update 2013-02-13 19:00:56 EST
Red Hat Product Errata RHSA-2013:0259 normal SHIPPED_LIVE Important: JBoss Enterprise Web Platform 5.2.0 security update 2013-02-13 19:00:47 EST
Red Hat Product Errata RHSA-2013:0644 normal SHIPPED_LIVE Important: apache-cxf security update 2013-03-13 18:49:09 EDT
Red Hat Product Errata RHSA-2013:0645 normal SHIPPED_LIVE Important: apache-cxf security update 2013-03-13 18:49:02 EDT
Red Hat Product Errata RHSA-2013:0649 normal SHIPPED_LIVE Important: Fuse ESB Enterprise 7.1.0 update 2013-03-14 16:48:11 EDT
Red Hat Product Errata RHSA-2013:0726 normal SHIPPED_LIVE Important: JBoss Enterprise SOA Platform 5.3.1 update 2013-04-09 18:11:58 EDT
Red Hat Product Errata RHSA-2013:0743 normal SHIPPED_LIVE Important: JBoss Enterprise BRMS Platform 5.3.1 update 2013-04-15 17:51:34 EDT
Red Hat Product Errata RHSA-2013:0749 normal SHIPPED_LIVE Important: apache-cxf security update 2013-04-16 18:53:46 EDT

  None (edit)
Description David Jorm 2012-12-19 21:15:54 EST 
If web services are deployed using Apache CXF with the WSS4JInInterceptor enabled to apply WS-Security processing, HTTP GET requests to these services will always be granted access, without applying authentication checks. The URIMappingInterceptor is a legacy mechanism for allowing REST-like access (via GET requests) to simple SOAP services. A remote attacker could use this flaw to access the REST-like interface of a simple SOAP service using GET requests that bypass the security constraints applied by WSS4JInInterceptor. This flaw is only exploitable if WSS4JInInterceptor is used to apply WS-Security processing. Services that use WS-SecurityPolicy to apply security are not affected.
Comment 1 David Jorm 2012-12-19 21:20:37 EST 
Upstream bug for JBoss Web Services:

https://issues.jboss.org/browse/JBWS-3575

Upstream bug for Apache CXF:

https://issues.apache.org/jira/browse/CXF-4629

Upstream patch commit for 2.6.x:

http://svn.apache.org/viewvc?view=revision&revision=1420756
Comment 4 Jan Lieskovsky 2013-02-08 08:58:16 EST 
Upstream advisory: http://cxf.apache.org/cve-2012-5633.html
Comment 6 Jan Lieskovsky 2013-02-08 09:06:02 EST 
Created cxf tracking bugs for this issue

Affects: fedora-all [bug 909247]
Comment 7 errata-xmlrpc 2013-02-13 13:52:05 EST 
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 5.2.0

Via RHSA-2013:0256 https://rhn.redhat.com/errata/RHSA-2013-0256.html
Comment 8 errata-xmlrpc 2013-02-13 14:02:44 EST 
This issue has been addressed in following products:

  JBEWP 5 for RHEL 4
  JBEWP 5 for RHEL 5
  JBEWP 5 for RHEL 6

Via RHSA-2013:0259 https://rhn.redhat.com/errata/RHSA-2013-0259.html
Comment 9 errata-xmlrpc 2013-02-13 14:02:50 EST 
This issue has been addressed in following products:

  JBoss Enterprise Web Platform 5.2.0

Via RHSA-2013:0258 https://rhn.redhat.com/errata/RHSA-2013-0258.html
Comment 10 errata-xmlrpc 2013-02-13 14:03:26 EST 
This issue has been addressed in following products:

  JBEAP 5 for RHEL 4
  JBEAP 5 for RHEL 5
  JBEAP 5 for RHEL 6

Via RHSA-2013:0257 https://rhn.redhat.com/errata/RHSA-2013-0257.html
Comment 11 errata-xmlrpc 2013-03-13 14:49:32 EDT 
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.0.1

Via RHSA-2013:0645 https://rhn.redhat.com/errata/RHSA-2013-0645.html
Comment 12 errata-xmlrpc 2013-03-13 14:49:57 EDT 
This issue has been addressed in following products:

  JBEAP 6 for RHEL 5
  JBEAP 6 for RHEL 6

Via RHSA-2013:0644 https://rhn.redhat.com/errata/RHSA-2013-0644.html
Comment 13 errata-xmlrpc 2013-03-14 12:49:04 EDT 
This issue has been addressed in following products:

  Fuse ESB Enterprise 7.1.0 Patch 3

Via RHSA-2013:0649 https://rhn.redhat.com/errata/RHSA-2013-0649.html
Comment 14 errata-xmlrpc 2013-04-09 14:19:44 EDT 
This issue has been addressed in following products:

  JBoss Enterprise SOA Platform 5.3.1

Via RHSA-2013:0726 https://rhn.redhat.com/errata/RHSA-2013-0726.html
Comment 15 errata-xmlrpc 2013-04-15 13:52:16 EDT 
This issue has been addressed in following products:

  JBoss Enterprise BRMS Platform 5.3.1

Via RHSA-2013:0743 https://rhn.redhat.com/errata/RHSA-2013-0743.html
Comment 16 errata-xmlrpc 2013-04-16 14:54:06 EDT 
This issue has been addressed in following products:

  JBoss Portal Platform 6.0.0

Via RHSA-2013:0749 https://rhn.redhat.com/errata/RHSA-2013-0749.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.