Vulnerability Description
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
CVSS Score
5.3
MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | >= 3.0.0, <= 3.0.13 |
Related Weaknesses (CWE)
References
- http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1&mPatchVendor Advisory
- http://www.securityfocus.com/bid/97968Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038279Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1832Issue Tracking
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de10
- https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b
- https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fd
- https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba7
- https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49
- https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a7
- http://cxf.apache.org/security-advisories.data/CVE-2017-5653.txt.asc?version=1&mPatchVendor Advisory
- http://www.securityfocus.com/bid/97968Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038279Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1832Issue Tracking
- https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de10
FAQ
What is CVE-2017-5653?
CVE-2017-5653 is a vulnerability with a CVSS score of 5.3 (MEDIUM). JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
How severe is CVE-2017-5653?
CVE-2017-5653 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5653?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf.