Bug 1445327 (CVE-2017-5653) - CVE-2017-5653 cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted
Summary: CVE-2017-5653 cxf: CXF JAX-RS XML Security streaming clients do not validate ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-5653
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1445335
Blocks: 1445347
TreeView+ depends on / blocked
 
Reported: 2017-04-25 13:40 UTC by Andrej Nemec
Modified: 2021-02-17 02:13 UTC (History)
63 users (show)

Fixed In Version: cxf 3.1.11, cxf 3.0.13
Doc Type: If docs needed, set a value
Doc Text:
It was found that a flaw exists in JAX-RS clients using the streaming approach for XML signatures and encryption, where it does not enforce the message to be signed/encrypted. This could allow an attacker to subvert the integrity of the message.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:11:10 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1832 0 normal SHIPPED_LIVE Important: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update 2017-08-15 05:47:49 UTC

Description Andrej Nemec 2017-04-25 13:40:58 UTC 
Apache CXF supports the ability to use XML Signature and encryption to secure
JAX-RS services. Two different implementations are available, a DOM based 
approach that works on a model of the message in memory before applying
security, and a streaming based implementation that is a useful alternative
for larger messages.

There is a bug in validating messages for JAX-RS clients using the streaming
approach, where it will not enforce that the message is signed and/or
encrypted. An exception is thrown in these cases but not properly propagated
to the client code. The bug does not apply for the DOM clients and it does not
apply for the streaming server side case.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc

Upstream patch:

https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=fade9b81dabe27f864ca38e7b40f28fb44d6f165
Comment 1 Andrej Nemec 2017-04-25 13:46:25 UTC 
Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1445335]
Comment 3 errata-xmlrpc 2017-08-10 23:04:57 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2017:1832 https://access.redhat.com/errata/RHSA-2017:1832
Note You need to log in before you can comment on or make changes to this bug.