Improper certificate validation in Apache CXF
Priority LOW 37CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Why it matters now
EPSS 0.11167 95th percentileScored 2026-11-07
Fix Partial Apache CXF (Apache Software Foundation): 3.0.13, 3.1.11org.apache.cxf:cxf-core (Maven): 3.1.11, 3.0.13Red Hat: 1 advisoryRed Hat: 2 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache CXF | before 3.0.13; 3.1 to before 3.1.11 | 3.0.13, 3.1.11 | Patch available | CNA |
| — | org.apache.cxf:cxf-core (Maven) | 3.1.0 to before 3.1.11 | 3.1.11 | Patch available | GHSA-hgg6-8x62-m9gf |
| — | org.apache.cxf:cxf-core (Maven) | before 3.0.13 | 3.0.13 | Patch available | GHSA-hgg6-8x62-m9gf |
- Apache CXF VendorApache Affected before 3.0.13; 3.1 to before 3.1.11 Fixed in 3.0.13, 3.1.11 Patch available CNA
- org.apache.cxf:cxf-core (Maven) Vendor— Affected 3.1.0 to before 3.1.11 Fixed in 3.1.11 Patch available GHSA-hgg6-8x62-m9gf
- org.apache.cxf:cxf-core (Maven) Vendor— Affected before 3.0.13 Fixed in 3.0.13 Patch available GHSA-hgg6-8x62-m9gf
Remediation
- Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 3.0.13, 3.1.11
- Fix · GHSA-hgg6-8x62-m9gf org.apache.cxf:cxf-core (Maven) Fixed in 3.1.11 Advisory →
- Fix · GHSA-hgg6-8x62-m9gf org.apache.cxf:cxf-core (Maven) Fixed in 3.0.13 Advisory →
Red Hat 1 advisory
- RHSA-2017:1832 Released 2017-08-10 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 2 | Affected | — |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:1832 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:1832 |
Not affected: 13 products
- Red Hat BPM Suite 6
- Red Hat JBoss BRMS 5
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
- Red Hat JBoss SOA Platform 5
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5653
- 2026-10-03 Alias added: GHSA-hgg6-8x62-m9gf
References
Other 14
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html
- https://github.com/apache/cxf/commit/20d0fa3ec41c16c52b74dcc006f9d9ea212fa80f
- https://github.com/apache/cxf
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E
More Apache Cxf vulnerabilities
- TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2017-5653 · CVE Program
- CVE-2017-5653 · NVD
- FIRST EPSS
- GHSA-hgg6-8x62-m9gf · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5653 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences