MEDIUM 6.5
GHSA-33j8-j763-4fv5
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Quick fix
GHSA-33j8-j763-4fv5 — org.apache.cxf:cxf-rt-rs-security-jose-jaxrs: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-jose-jaxrsDetails
A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption
that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.apache.cxf:cxf-rt-rs-security-jose-jaxrs
Introduced in:
4.2.0 Fixed in: 4.2.2 Fix
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-jose-jaxrs Maven / org.apache.cxf:cxf-rt-rs-security-jose-jaxrs
Introduced in:
0 Fixed in: 4.1.7 Fix
# pom.xml: bump <version>4.1.7</version> for org.apache.cxf:cxf-rt-rs-security-jose-jaxrs