You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by Colm O hEigeartaigh <co...@apache.org> on 2019/11/05 15:53:14 UTC

[CVE-2019-12406] Apache CXF does not restrict the number of message attachments

[CVEID]:CVE-2019-12406
[PRODUCT]:Apache CXF
[VERSION]:Apache CXF versions before 3.3.4 and 3.2.11
[PROBLEMTYPE]:Denial of Service
[REFERENCES]:
http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc
[DESCRIPTION]:Apache CXF does not restrict the number of message
attachments present in a
              given message. This leaves open the possibility of a denial
of service type
              attack, where a malicious user crafts a message containing a
very large number
              of message attachments.

              From the 3.3.4 and 3.2.11 releases, a default limit of 50
message attachments
              is enforced. This is configurable via the message property
              "attachment-max-count".