Read the docs
TI-2012-04691 Aliases CVE-2012-5575GHSA-7v5v-9v8r-w864

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does…

Priority LOW 38CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Partial Red Hat: 16 fixed, 6 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-326.

Summary

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

Why it matters now

EPSS 0.06322 93rd percentileScored 2026-11-07
Fix Partial org.apache.cxf:cxf-rt-transports-http (Maven): 2.5.10, 2.6.7, 2.7.4Red Hat: 12 advisoriesRed Hat: 16 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.cxf:cxf-rt-transports-http (Maven)2.5.0 to before 2.5.102.5.10Patch availableGHSA-7v5v-9v8r-w864
—org.apache.cxf:cxf-rt-transports-http (Maven)2.6.0 to before 2.6.72.6.7Patch availableGHSA-7v5v-9v8r-w864
—org.apache.cxf:cxf-rt-transports-http (Maven)2.7.0 to before 2.7.42.7.4Patch availableGHSA-7v5v-9v8r-w864
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.cxf:cxf-rt-transports-http (Maven) Vendor— Affected 2.5.0 to before 2.5.10 Fixed in 2.5.10 Patch available GHSA-7v5v-9v8r-w864
  • org.apache.cxf:cxf-rt-transports-http (Maven) Vendor— Affected 2.6.0 to before 2.6.7 Fixed in 2.6.7 Patch available GHSA-7v5v-9v8r-w864
  • org.apache.cxf:cxf-rt-transports-http (Maven) Vendor— Affected 2.7.0 to before 2.7.4 Fixed in 2.7.4 Patch available GHSA-7v5v-9v8r-w864

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableApache
cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableApache
cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableApache
cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableApache
cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*2.5.4VulnerableApache
cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*2.5.5VulnerableApache
cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*2.5.6VulnerableApache
cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*2.5.7VulnerableApache
cpe:2.3:a:apache:cxf:2.5.8:*:*:*:*:*:*:*2.5.8VulnerableApache
cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*2.5.9VulnerableApache
  • cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:* Versions 2.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.8:*:*:*:*:*:*:* Versions 2.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:* Versions 2.5.9 Vulnerable ·Apache
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableApache
cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableApache
cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableApache
cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*2.6.3VulnerableApache
cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*2.6.4VulnerableApache
cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*2.6.5VulnerableApache
cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*2.6.6VulnerableApache
cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableApache
cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableApache
cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableApache
cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse_esb_enterprise:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
  • cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Apache
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_portal_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_soa_platform:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_web_platform:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse_esb_enterprise:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-7v5v-9v8r-w864 org.apache.cxf:cxf-rt-transports-http (Maven) Fixed in 2.5.10 Advisory →
  • Fix · GHSA-7v5v-9v8r-w864 org.apache.cxf:cxf-rt-transports-http (Maven) Fixed in 2.6.7 Advisory →
  • Fix · GHSA-7v5v-9v8r-w864 org.apache.cxf:cxf-rt-transports-http (Maven) Fixed in 2.7.4 Advisory →

Red Hat 12 advisories

  • RHSA-2013:1437 Released 2013-10-16 · Red Hat rating Important
    Red Hat JBoss Portal 6.1.0 update
    • Red Hat JBoss Portal Platform 6.1
  • RHSA-2013:1028 Released 2013-07-09 · Red Hat rating Important
    Fuse ESB Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
  • RHSA-2013:1006 Released 2013-07-01 · Red Hat rating Important
    Red Hat JBoss BRMS 5.3.1 update
    • JBoss Enterprise BRMS Platform 5.3
Show 9 more Red Hat advisories
  • RHSA-2013:0953 Released 2013-06-18 · Red Hat rating Important
    Red Hat JBoss Portal 5.2.2 security update
    • Red Hat JBoss Portal 5.2
  • RHSA-2013:0943 Released 2013-06-12 · Red Hat rating Important
    Red Hat JBoss SOA Platform 5.3.1 update
    • Red Hat JBoss SOA Platform 5.3
  • RHSA-2013:0876 Released 2013-05-28 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5.2
  • RHSA-2013:0875 Released 2013-05-28 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5.2
  • RHSA-2013:0874 Released 2013-05-28 · Red Hat rating Important
    JBoss Enterprise Web Platform 5.2.0 security update
    • Red Hat JBoss Web Platform 5 for RHEL 5 Server apache-cxf-2.2.12-12.patch_07.ep5.el5, jbossws-3.1.2-14.SP15_patch_02.ep5.el5, wss4j-1.5.12-6_patch_03.ep5.el5
    • Red Hat JBoss Web Platform 5 for RHEL 6 Server apache-cxf-2.2.12-12.patch_07.ep5.el6, jbossws-3.1.2-14.SP15_patch_02.ep5.el6, wss4j-1.5.12-6_patch_03.ep5.el6
  • RHSA-2013:0873 Released 2013-05-28 · Red Hat rating Important
    JBoss Enterprise Application Platform 5.2.0 security update
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS apache-cxf-2.2.12-12.patch_07.ep5.el4, jbossws-3.1.2-14.SP15_patch_02.ep5.el4, wss4j-1.5.12-6_patch_03.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES apache-cxf-2.2.12-12.patch_07.ep5.el4, jbossws-3.1.2-14.SP15_patch_02.ep5.el4, wss4j-1.5.12-6_patch_03.ep5.el4
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server apache-cxf-2.2.12-12.patch_07.ep5.el5, jbossws-3.1.2-14.SP15_patch_02.ep5.el5, wss4j-1.5.12-6_patch_03.ep5.el5
    • Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server apache-cxf-2.2.12-12.patch_07.ep5.el6, jbossws-3.1.2-14.SP15_patch_02.ep5.el6, wss4j-1.5.12-6_patch_03.ep5.el6
  • RHSA-2013:0839 Released 2013-05-20 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.1.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5.i386 +47
  • RHSA-2013:0834 Released 2013-05-20 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.1.0 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6.i386 +47
  • RHSA-2013:0833 Released 2013-05-20 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.1.0 update
    • Red Hat JBoss Enterprise Application Platform 6.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix yet
Red Hat JBoss Portal 4AffectedNo fix yet
Red Hat JBoss Portal 5AffectedNo fix yet
Red Hat JBoss Portal 6AffectedNo fix yet
Red Hat JBoss SOA Platform 4AffectedNo fix yet
Red Hat JBoss SOA Platform 5AffectedNo fix yet
Fuse ESB Enterprise 7.1.0Fixed RHSA-2013:1028
JBoss Enterprise BRMS Platform 5.3Fixed RHSA-2013:1006
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ASFixed RHSA-2013:0873
Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ESFixed RHSA-2013:0873
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 ServerFixed RHSA-2013:0873
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 ServerFixed RHSA-2013:0873
Red Hat JBoss Enterprise Application Platform 5.2Fixed RHSA-2013:0875
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2013:0839
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2013:0834
Red Hat JBoss Enterprise Application Platform 6.1Fixed RHSA-2013:0833
Red Hat JBoss Portal 5.2Fixed RHSA-2013:0953
Red Hat JBoss Portal Platform 6.1Fixed RHSA-2013:1437
Red Hat JBoss SOA Platform 5.3Fixed RHSA-2013:0943
Red Hat JBoss Web Platform 5 for RHEL 5 ServerFixed RHSA-2013:0874
Red Hat JBoss Web Platform 5 for RHEL 6 ServerFixed RHSA-2013:0874
Red Hat JBoss Web Platform 5.2Fixed RHSA-2013:0876
Not affected: 2 products
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS
  • Red Hat JBoss Web Platform 5 for RHEL 4 ES

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5575
  2. 2026-10-03 Alias added: GHSA-7v5v-9v8r-w864

References

Advisory 12

Other 16

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences