HIGH 8.2
GHSA-f8p7-h97q-7vx7
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Quick fix
GHSA-f8p7-h97q-7vx7 — org.apache.cxf:cxf-rt-rs-security-oauth2: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-oauth2Details
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Introduced in:
4.2.0 Fixed in: 4.2.2 Fix
# pom.xml: bump <version>4.2.2</version> for org.apache.cxf:cxf-rt-rs-security-oauth2 Maven / org.apache.cxf:cxf-rt-rs-security-oauth2
Introduced in:
0 Fixed in: 4.1.7 Fix
# pom.xml: bump <version>4.1.7</version> for org.apache.cxf:cxf-rt-rs-security-oauth2