CVE-2017-5653: Medium severity Apache CXF vulnerability
Apache CXF supports the ability to use XML Signature and encryption to secure JAX-RS services. Two different implementations are available, a DOM based approach that works on a model of the message in memory before applying security, and a streaming based implementation that is a useful alternative for larger messages.
There is a bug in validating messages for JAX-RS clients using the streaming approach, where it will not enforce that the message is signed and/or encrypted. An exception is thrown in these cases but not properly propagated to the client code. The bug does not apply for the DOM clients and it does not apply for the streaming server side case.
External References:
http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc
Upstream patch:
https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=commit;h=fade9b81dabe27f864ca38e7b40f28fb44d6f165
Other sources
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.cxf:cxf-coreto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
maven/org.apache.cxf:cxf-coreto a version that resolves this vulnerability.Fixed in 3.1.11 - Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.1.11 - Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.0.13 - Upgrade
Upgrade
Apache CXF JAX-RS XML Security (streaming clients)to a version that resolves this vulnerability.Fixed in 3.1.11 - Upgrade
Upgrade
Apache CXF JAX-RS XML Security (streaming clients)to a version that resolves this vulnerability.Fixed in 3.0.13
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5653?
CVE-2017-5653 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-5653?
To fix CVE-2017-5653, upgrade Apache CXF to version 3.1.11 or 3.0.13.
What versions of Apache CXF are affected by CVE-2017-5653?
CVE-2017-5653 affects Apache CXF versions between 3.0.0 and 3.0.13 as well as between 3.1.0 and 3.1.11.
What types of services does CVE-2017-5653 impact?
CVE-2017-5653 impacts JAX-RS services that utilize XML Signature and encryption in Apache CXF.
Is CVE-2017-5653 specific to any particular software environment?
CVE-2017-5653 is relevant primarily to environments running Apache CXF for web services.