CVE-2014-0109: Medium severity Apache CXF vulnerability
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
Other sources
If content is posted to a SOAP endpoint with Content-Type text/html, CXF creates an error message based on the input. This could potentially cause a Out Of Memory (OOM) error on a large input, leading to a possible Denial of Service attack.
Affected versions: Apach CXF 2.6.x < 2.6.14 Apach CXF 2.7.x < 2.7.11
References: http://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc
Upstream fix: https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=f8ed98e684c1a67a77ae8726db05a04a4978a445
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0109?
CVE-2014-0109 is classified as a denial of service vulnerability due to memory consumption.
How do I fix CVE-2014-0109?
To fix CVE-2014-0109, upgrade Apache CXF to version 2.6.14 or 2.7.11 and later.
Which versions of Apache CXF are affected by CVE-2014-0109?
CVE-2014-0109 affects Apache CXF versions before 2.6.14 and 2.7.x before 2.7.11.
Can CVE-2014-0109 be exploited remotely?
Yes, CVE-2014-0109 can be exploited remotely by sending a large request with the Content-Type set to text/html.
What types of attacks can CVE-2014-0109 facilitate?
CVE-2014-0109 can facilitate denial of service attacks causing application crashes or memory exhaustion.