rootvector2 opened a new pull request, #3632: URL: https://github.com/apache/cxf/pull/3632
`AbstractSignatureInFilter.verifyDigest` only read the entity when a `Digest` header was present, so `MessageVerifier` got a null body and never required a signed digest for a DELETE request body or a response body (found by reviewing the http-signature filters), letting a MITM attach an unsigned body to a validly signed message; the filter now reads the body whenever there is one so the existing digest requirement applies. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
