Inadequate Encryption Strength in Apache CXF
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 13, 2023
Package
Affected versions
>= 2.5.0, < 2.5.10
>= 2.6.0, < 2.6.7
>= 2.7.0, < 2.7.4
Patched versions
2.5.10
2.6.7
2.7.4
Description
Published by the National Vulnerability Database
Aug 19, 2013
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 13, 2022
Last updated
Feb 13, 2023
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
References