CVE-2012-5786: Input Validation
DISPUTED The wsdlfirsthttps sample code in distribution/src/main/release/samples/wsdlfirsthttps/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5786?
CVE-2012-5786 is considered a moderate severity vulnerability due to improper hostname verification in Apache CXF.
How do I fix CVE-2012-5786?
To fix CVE-2012-5786, upgrade Apache CXF to version 2.7.0 or later.
What types of attacks can exploit CVE-2012-5786?
CVE-2012-5786 can be exploited by man-in-the-middle attacks due to the lack of hostname verification.
Which versions of Apache CXF are affected by CVE-2012-5786?
Apache CXF versions up to and including 2.6.17 are affected by CVE-2012-5786.
Is CVE-2012-5786 a protocol-specific vulnerability?
Yes, CVE-2012-5786 specifically affects the HTTPS implementation in Apache CXF.