Medium WID-SEC-2024-1678 3 CVEs

Apache CXF: Mehrere Schwachstellen

Published Jul 18, 2024 · Updated May 19, 2026 · Revision 10 · de-DE

Vendor: Apache Vendor: Atlassian Vendor: IBM Vendor: NETAPP Vendor: RealObjects Vendor: Red Hat Product: ActiveIQ Unified Manager Product: Bitbucket Product: CXF Product: Enterprise Linux Product: PDFreactor Product: QRadar SIEM Platform: Linux Platform: Windows

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.

Product

Apache CXF ist ein Open Source-Web Service-Framework.

Vulnerabilities 3

High 7.5

CVE-2024-29736

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.

Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-service-description Maven

Jul 19, 2024
High 7.5

CVE-2024-32007

Apache CXF Denial of Service vulnerability in JOSE

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-rs-security-jose Maven

Jul 19, 2024
Medium 5.3

CVE-2024-41172

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventua…

Apache Software Foundation Apache CXF org.apache.cxf:cxf-rt-transports-http Maven

Jul 19, 2024

Revision history

2026-05-19 #10
Neue Updates von NetApp aufgenommen
2025-03-05 #9
Neue Updates aufgenommen
2025-02-03 #8
Neue Updates von IBM aufgenommen
2024-11-17 #7
Neue Updates von NetApp aufgenommen
2024-11-04 #6
Neue Updates von Red Hat aufgenommen
2024-09-24 #5
Neue Updates von Red Hat aufgenommen
2024-09-19 #4
Neue Updates von Red Hat aufgenommen
2024-09-17 #3
Neue Updates aufgenommen
2024-09-09 #2
Neue Updates von Red Hat aufgenommen
2024-07-18 #1
Initiale Fassung

References

Apache Security Advisory vom 2024-07-18
https://cxf.apache.org/security-advisories.data/CVE-2024-29736.txt?version=1&modificationDate=1721314668000&api=v2
Apache Security Advisory vom 2024-07-18
https://cxf.apache.org/security-advisories.data/CVE-2024-32007.txt?version=1&modificationDate=1721314761000&api=v2
Red Hat Security Advisory RHSA-2024:6508 vom 2024-09-10
https://access.redhat.com/errata/RHSA-2024:6508
Red Hat Security Advisory RHSA-2024:6508 vom 2024-09-10
https://rhn.redhat.com/errata/RHSA-2024:6508.html
Atlassian Security Bulletin - September 17 2024
https://confluence.atlassian.com/security/security-bulletin-september-17-2024-1431249025.html
Red Hat Security Advisory RHSA-2024:6883 vom 2024-09-19
https://access.redhat.com/errata/RHSA-2024:6883
Red Hat Security Advisory RHSA-2024:7052 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:7052
Red Hat Security Advisory RHSA-2024:8823 vom 2024-11-04
https://access.redhat.com/errata/RHSA-2024:8823
Red Hat Security Advisory RHSA-2024:8824 vom 2024-11-04
https://access.redhat.com/errata/RHSA-2024:8824
Red Hat Security Advisory RHSA-2024:8826 vom 2024-11-04
https://access.redhat.com/errata/RHSA-2024:8826
NetApp Security Advisory NTAP-20241115-0003 vom 2024-11-15
https://security.netapp.com/advisory/ntap-20241115-0003/
IBM Security Bulletin 7182335 vom 2025-02-03
https://www.ibm.com/support/pages/node/7182335
PDFreactor Releasenotes vom 2025-03-06
https://www.pdfreactor.com/pdfreactor-12-1-now-available/
NetApp Security Advisory NTAP-20240808-0009 vom 2026-05-20
https://security.netapp.com/advisory/NTAP-20240808-0009