You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@cxf.apache.org by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2026/10/09 16:11:00 UTC

[jira] [Resolved] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch

     [ https://issues.apache.org/jira/browse/CXF-8328?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh resolved CXF-8328.
--------------------------------------
    Resolution: Won't Fix

> CVE-2019-12406 not fixed in 3.1 branch
> --------------------------------------
>
>                 Key: CXF-8328
>                 URL: https://issues.apache.org/jira/browse/CXF-8328
>             Project: CXF
>          Issue Type: Bug
>          Components: Core
>    Affects Versions: 3.1.18
>            Reporter: Robert Schaft
>            Priority: Major
>              Labels: CVE
>
> CVE-2019-12406 is currently the only open relevant Cybersecurity issue in TomEE 7.x (see TOMEE-2876) according to known vulnerability database.
> TomEE 7.x is claiming to be a stable supported version. But it depends on CXF 3.1, which has at least the vulnerability reported in [CVE-2019-12406|http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc].
> As I understood, it can't be fixed in TomEE without following the API change of CXF 3.2, which the TomEE team is reluctant to do.
> From the distant perspective, a backport to CXF 3.1 of the attachment-max-count feature doesn't look complicated.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)