CVE-2019-12406: Medium severity Apache CXF vulnerability
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Other sources
Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a given message. By sending a specially-crafted message containing an overly large number of message attachments, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.3.4 - Upgrade
Upgrade
redhat/cxfto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.3.4 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.2.11 - Configuration
If not already in place, configure CXF message property "attachment-max-count" to enforce a default limit of 50 message attachments per message.
Apache CXF attachment-max-count = 50 - Compensating control
Set/keep a limit on the maximum number of message attachments via CXF message property "attachment-max-count" to reduce denial-of-service risk from specially-crafted messages with excessive attachments.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-12406?
CVE-2019-12406 is a vulnerability in Apache CXF that allows a malicious user to perform a denial of service attack by sending a message with a large number of attachments.
What is the severity of CVE-2019-12406?
The severity of CVE-2019-12406 is medium with a CVSS score of 6.5.
How does CVE-2019-12406 affect Apache CXF?
CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11, allowing a denial of service attack by exploiting the unrestricted number of message attachments.
How can I fix CVE-2019-12406?
To fix CVE-2019-12406, upgrade to Apache CXF version 3.3.4 or 3.2.11.
Where can I find more information about CVE-2019-12406?
More information about CVE-2019-12406 can be found at the following references: [link 1], [link 2], [link 3].