CVE-2014-0035: Medium severity apache cxf vulnerability
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Other sources
UsernameTokens are sent in plaintext, i.e. not encrypted, by a CXF client that uses a SymmetricBinding with EncryptBeforeSigning enabled, and a UsernameToken policy that is a EncryptedSupportingToken. No other binding is affected, and SignBeforeEncrypting is not affected either.
Affected versions: Apach CXF 2.6.x < 2.6.13 Apach CXF 2.7.x < 2.7.10
NOTE from apache advisory: Although this vulnerability has been fixed in CXF 2.6.13 and 2.7.10, due to other security advisories it is recommended to upgrade to the following releases: CXF 2.6.x users should upgrade to 2.6.14 or later as soon as possible. CXF 2.7.x users should upgrade to 2.7.11 or later as soon as possible.
References: http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc
Upstream fix: http://svn.apache.org/viewvc?view=revision&revision=1564724
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0035?
CVE-2014-0035 has a medium severity as it allows sensitive information to be transmitted in cleartext.
How do I fix CVE-2014-0035?
To fix CVE-2014-0035, you should upgrade to Apache CXF version 2.6.13 or 2.7.10, or later.
What versions of Apache CXF are affected by CVE-2014-0035?
CVE-2014-0035 affects Apache CXF versions prior to 2.6.13 and 2.7.x versions before 2.7.10.
What is the impact of CVE-2014-0035?
The impact of CVE-2014-0035 is that it may expose username tokens to attackers, leading to unauthorized access.
Is there a workaround for CVE-2014-0035 if I cannot upgrade?
There is no specific workaround for CVE-2014-0035; upgrading to a patched version is recommended.