CLSA-2026-1794631117: TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.4.5-tuxcare.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-rt-rs-security-oauth2to a version that resolves this vulnerability.Fixed in 3.4.5-tuxcare.7 - Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-rt-transports-http-netty-clientto a version that resolves this vulnerability.Fixed in 3.4.5-tuxcare.7 - Upgrade
Upgrade
tuxcare/org.apache.cxf:cxf-rt-ws-securityto a version that resolves this vulnerability.Fixed in 3.4.5-tuxcare.7 - Upgrade
Upgrade
org.apache.cxfto a version that resolves this vulnerability.Fixed in 3.4.5-tuxcare.7
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which packages need to be updated?
The affected packages are cxf-rt-rs-security-oauth2, cxf-rt-transports-http-netty-client, and cxf-rt-ws-security from TuxCare's org.apache.cxf distribution.
What fixed version should be deployed?
Deploy version 3.4.5-tuxcare.7 of the rebuilt org.apache.cxf packages. The update addresses five CVEs.