CVE-2012-5575: Medium severity apache cxf vulnerability
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Other sources
Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky have described XML encryption backwards compatibility attacks against various frameworks, including Apache CXF. An attacker can use these flaws to force a server to utilize insecure, legacy cryptosystems when secure cryptosystems are enabled on endpoints. This could expose flaws in the underlying legacy cryptosystems, such as CVE-2011-1096 and CVE-2011-2487. This flaw also affects the jbossws-native stack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5575?
CVE-2012-5575 is considered a moderate severity vulnerability due to the potential for weak cryptographic algorithm usage.
How do I fix CVE-2012-5575?
To fix CVE-2012-5575, upgrade Apache CXF to version 2.5.10, 2.6.7, or 2.7.4 or later.
Which versions of Apache CXF are vulnerable to CVE-2012-5575?
Apache CXF versions 2.5.0 to 2.5.9, 2.6.0 to 2.6.6, and 2.7.0 to 2.7.3 are vulnerable to CVE-2012-5575.
What type of attacks can be performed using CVE-2012-5575?
CVE-2012-5575 allows attackers to force the use of weaker cryptographic algorithms during decryption.
Is there a patch available for CVE-2012-5575?
Yes, patches are available in the updated versions of Apache CXF released after the vulnerability was identified.