Red Hat Security AdvisoryRHSA-2013:0644
apache-cxf security update
Released 2013-03-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server apache-cxf-2.4.9-6.redhat_3.ep6.el5
- Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-cxf-2.4.9-6.redhat_3.ep6.el6
Fixes 2 records
Priority LOW 37
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.08157 · Published 2013-03-12 · Partial fix · 2.5.8, 2.6.5 +1 CWE-287
Priority LOW 30
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04687 · Published 2013-03-12 · Partial fix · 2.5.9, 2.6.6 +1 CWE-287
