[CONF] Apache CXF > Security Advisories

[confluence]

Security Advisories Page edited by Colm O hEigeartaigh Changes (2) * [Note on CVE-2011-2487|Note on CVE-2011-2487] - jbossws: Prone to Bleichenbacher attack against to be distributed symmetric key. * [Note on CVE-2011-2487|Note on CVE-2011-2487] - Bleichenbacher attack against distributed symmetric key in WS-Security. * [CVE-2012-3451|CVE-2012-3451] - Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services. * [CVE-2012-2379|CVE-2012-2379] - Apache CXF does not verify that elements were signed or encrypted by a particular Supporting Token. ... Full Content Note on CVE-2011-2487 - Bleichenbacher attack against distributed symmetric key in WS-Security. CVE-2012-3451 - Apache CXF is vulnerable to SOAP Action spoofing attacks on Document Literal web services. CVE-2012-2379 - Apache CXF does not verify that elements were signed or encrypted by a particular Supporting Token. CVE-2012-2378 - Apache CXF does not pick up some child policies of WS-SecurityPolicy 1.1 SupportingToken policy assertions on the client side. Note on CVE-2011-1096 - XML Encryption flaw / Character pattern encoding attack. CVE-2012-0803 - Apache CXF does not validate UsernameToken policies correctly. CVE-2010-2076 - DTD based XML attacks. Change Notification Preferences View Online | View Changes | Add Comment