Vulnerability Description
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | 2.5.0 |
| Redhat | Jboss Enterprise Application Platform | 5.0.0 |
| Redhat | Jboss Enterprise Portal Platform | 4.3.0 |
| Redhat | Jboss Enterprise Soa Platform | 4.3.0 |
| Redhat | Jboss Enterprise Web Platform | 5.2.0 |
| Redhat | Jboss Fuse Esb Enterprise | 7.1.0 |
Related Weaknesses (CWE)
References
- http://cxf.apache.org/cve-2012-5575.html
- http://rhn.redhat.com/errata/RHSA-2013-0833.html
- http://rhn.redhat.com/errata/RHSA-2013-0834.html
- http://rhn.redhat.com/errata/RHSA-2013-0839.html
- http://rhn.redhat.com/errata/RHSA-2013-0873.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0874.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0875.html
- http://rhn.redhat.com/errata/RHSA-2013-0876.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0943.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1028.html
- http://rhn.redhat.com/errata/RHSA-2013-1143.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1437.html
- http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/
- http://www.securityfocus.com/bid/60043
- https://bugzilla.redhat.com/show_bug.cgi?id=880443
FAQ
What is CVE-2012-5575?
CVE-2012-5575 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definitio...
How severe is CVE-2012-5575?
CVE-2012-5575 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5575?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Soa Platform, Redhat Jboss Enterprise Web Platform.