CVE-2017-12624: Input Validation
A flaw was found in Apache CXF prior to 3.2.1 and 3.1.14. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack.
Upstream patch:
https://github.com/apache/cxf/commit/8bd915bfd7735c248ad660059c6b6ad26cdbcdf6
References:
http://cxf.apache.org/security-advisories.data/CVE-2017-12624.txt.asc
Other sources
Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to cause the AX-WS and JAX-RS services stop responding.
— IBM
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-12624?
CVE-2017-12624 is a vulnerability in Apache CXF that allows for a denial of service (DoS) attack by using a specially crafted message attachment header.
Which software versions are affected by CVE-2017-12624?
Apache CXF versions up to and including 3.1.14 and 3.2.1 are affected by CVE-2017-12624.
How can I fix CVE-2017-12624?
To fix CVE-2017-12624, upgrade your Apache CXF software to version 3.1.15 or 3.2.2.
What is the severity of CVE-2017-12624?
CVE-2017-12624 has a severity rating of 5.5, which is considered medium.
Where can I find more information about CVE-2017-12624?
You can find more information about CVE-2017-12624 in the Apache CXF security advisories and the Red Hat Bugzilla.