You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cxf.apache.org by Colm O hEigeartaigh <co...@apache.org> on 2017/04/18 12:01:31 UTC
New security advisories for Apache CXF
The Apache CXF project has released two new security advisories:
a) CVE-2017-5653: Apache CXF JAX-RS XML Security streaming clients do not
validate that the service response was signed or encrypted.
b) CVE-2017-5656: Apache CXF's STSClient uses a flawed way of caching
tokens that are associated with delegation tokens.
More details, including the text of the security advisories, are available
at:
http://cxf.apache.org/security-advisories.html
Colm.
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: New security advisories for Apache CXF
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Dennis,
The Apache security team suggested I document my objection to the CVE in a
public place (this mailing list for example) before informing Mitre that
the CVE is disputed. So I'll do that in this post.
A security advisory was issued for Apache CXF back in 2012, where the
advisory itself was never agreed upon with the Apache CXF PMC:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5786
In a nutshell, the advisory was that a sample that shipped with CXF had a
flag enabled which bypassed checking the DN check for a TLS certificate. We
since removed this flag from the sample configuration to prevent a user
unwittingly copying the configuration when setting up a deployment.
However, the fact remains that the issue reported was not a vulnerability
in CXF itself.
The issue has resurfaced recently in the context of the Maven Owasp
dependency checker, which downloads the advisory and is telling users of
(old) versions of CXF that there is a vulnerability associated with the
version they are using, when clearly there is not.
Colm.
On Wed, Apr 19, 2017 at 3:04 PM, Colm O hEigeartaigh <co...@apache.org>
wrote:
> Thanks, I'm going to ask the Apache security team for some advice on how
> to handle this.
>
> Colm.
>
> On Wed, Apr 19, 2017 at 12:30 PM, Dennis Kieselhorst <de...@apache.org>
> wrote:
>
>> > Could you file an issue with the OWasp plugin instead to remove this CVE
>> > from their list (if this is possible - I'm not sure how they are pulling
>> > down advisories)?
>>
>> The plugin downloads the NVD CVE data hosted by NIST.
>>
>> So to get rid of it, the configuration pattern
>> cpe:2.3:a:apache:cxf:-:*:*:*:*:*:*:* needs to be changed:
>> https://nvd.nist.gov/vuln/detail/CVE-2012-5786
>>
>> No idea how to achieve that.
>>
>> Regards
>> Dennis
>>
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: New security advisories for Apache CXF
Posted by Colm O hEigeartaigh <co...@apache.org>.
Thanks, I'm going to ask the Apache security team for some advice on how to
handle this.
Colm.
On Wed, Apr 19, 2017 at 12:30 PM, Dennis Kieselhorst <de...@apache.org>
wrote:
> > Could you file an issue with the OWasp plugin instead to remove this CVE
> > from their list (if this is possible - I'm not sure how they are pulling
> > down advisories)?
>
> The plugin downloads the NVD CVE data hosted by NIST.
>
> So to get rid of it, the configuration pattern
> cpe:2.3:a:apache:cxf:-:*:*:*:*:*:*:* needs to be changed:
> https://nvd.nist.gov/vuln/detail/CVE-2012-5786
>
> No idea how to achieve that.
>
> Regards
> Dennis
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: New security advisories for Apache CXF
Posted by Dennis Kieselhorst <de...@apache.org>.
> Could you file an issue with the OWasp plugin instead to remove this CVE
> from their list (if this is possible - I'm not sure how they are pulling
> down advisories)?
The plugin downloads the NVD CVE data hosted by NIST.
So to get rid of it, the configuration pattern cpe:2.3:a:apache:cxf:-:*:*:*:*:*:*:* needs to be changed: https://nvd.nist.gov/vuln/detail/CVE-2012-5786
No idea how to achieve that.
Regards
Dennis
Re: New security advisories for Apache CXF
Posted by Colm O hEigeartaigh <co...@apache.org>.
Could you file an issue with the OWasp plugin instead to remove this CVE
from their list (if this is possible - I'm not sure how they are pulling
down advisories)?
Colm.
On Wed, Apr 19, 2017 at 7:41 AM, Dennis Kieselhorst <de...@apache.org> wrote:
> > It's not a bug - that advisory was just raised against a sample that CXF
> > ships with.
>
> I know, unfortunately the dependency check reports it as soon as any CXF
> dependency is present (try mvn org.owasp:dependency-check-maven:check to
> reproduce). If failBuildOnCVSS is set, the build will fail unless you
> define a suppression for it.
>
> That's why I thought a comment might be useful for users that hit this CVE.
>
> Regards
> Dennis
>
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: New security advisories for Apache CXF
Posted by Dennis Kieselhorst <de...@apache.org>.
> It's not a bug - that advisory was just raised against a sample that CXF
> ships with.
I know, unfortunately the dependency check reports it as soon as any CXF dependency is present (try mvn org.owasp:dependency-check-maven:check to reproduce). If failBuildOnCVSS is set, the build will fail unless you define a suppression for it.
That's why I thought a comment might be useful for users that hit this CVE.
Regards
Dennis
Re: New security advisories for Apache CXF
Posted by Colm O hEigeartaigh <co...@apache.org>.
It's not a bug - that advisory was just raised against a sample that CXF
ships with.
Colm.
On Tue, Apr 18, 2017 at 4:51 PM, Dennis Kieselhorst <de...@apache.org> wrote:
> Hi,
>
> OWASP dependency check still reports CVE-2012-5786 and it's not on the
> list. Should we add it?
>
> Regards
> Dennis
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: New security advisories for Apache CXF
Posted by Dennis Kieselhorst <de...@apache.org>.
Hi,
OWASP dependency check still reports CVE-2012-5786 and it's not on the list. Should we add it?
Regards
Dennis