Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 o

Summary

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.

Timeline

1. Jan 3, 2013, 1:00 AM UTCCVE published
2. Aug 6, 2024, 7:34 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• org.apache.cxf:cxfMaven

  From 2.4.0 · fixed in 2.4.8

• org.apache.cxf:cxfMaven

  From 2.5.0 · fixed in 2.5.4

• org.apache.cxf:cxfMaven

  From 2.6.0 · fixed in 2.6.1

References 24