Vulnerability Description
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cxf | < 3.1.16 |
| Redhat | Jboss Enterprise Application Platform | 7.1.0 |
Related Weaknesses (CWE)
References
- http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&mMailing ListVendor Advisory
- http://www.securityfocus.com/bid/106357
- http://www.securitytracker.com/id/1041199Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2276Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2277Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2279Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2423Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2424Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2425Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2428Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2643Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2018:3817
- https://github.com/apache/cxf/commit/fae6fabf9bd7647f5e9cb68897a7d72b545b741bPatchThird Party Advisory
- https://lists.apache.org/thread.html/1f8ff31df204ad0374ab26ad333169e0387a5e7ec92
FAQ
What is CVE-2018-8039?
CVE-2018-8039 is a vulnerability with a CVSS score of 8.1 (HIGH). It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system prop...
How severe is CVE-2018-8039?
CVE-2018-8039 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-8039?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cxf, Redhat Jboss Enterprise Application Platform.