Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc?version=1&modificationDate=1482164360575&api=v2

Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMac secret key algorithms.

This vulnerability affects all versions of Apache CXF prior to 3.0.13, 3.1.10.

Upstream patches:

CXF 3.1.x: http://git-wip-us.apache.org/repos/asf/cxf/commit/555843f9

CXF 3.0.x http://git-wip-us.apache.org/repos/asf/cxf/commit/1338469f

CXF 3.2.0-SNAPSHOT (master): http://git-wip-us.apache.org/repos/asf/cxf/commit/e66ce235

External References:

https://cxf.apache.org/security-advisories.data/CVE-2017-3156.txt.asc

Apache CXF HTTP transport module uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.

External References:

http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc?version=1&modificationDate=1482164360602&api=v2