Description
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >= 2.5.0, < 2.6.11 | 2.6.11 | GHSA-gw5j-77f9-v2g2 |
| Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >= 2.7.0, < 2.7.8 | 2.7.8 | GHSA-gw5j-77f9-v2g2 |
| Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >= 3.0.0, < 3.0.1 | 3.0.1 | GHSA-gw5j-77f9-v2g2 |
References
- [oss-security] 20141024 New security advisories released for Apache CXF mailing-list
- 61909 third-party-advisory
- 70738 vdb-entry
- apache-cxf-cve20143584-dos(97753) vdb-entry
- http://cxf.apache.org/security-advisories.data/CVE-2014-3584.txt.asc
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list