Apache CXF up to 3.2.10/3.3.3 Attachment Message resource consumption

Summaryinfo

A vulnerability identified as problematic has been detected in Apache CXF up to 3.2.10/3.3.3. Affected is an unknown function of the component Attachment Handler. The manipulation as part of Message leads to resource consumption. This vulnerability is listed as CVE-2019-12406. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache CXF up to 3.2.10/3.3.3 (Application Server Software). It has been rated as problematic. This issue affects some unknown functionality of the component Attachment Handler. The manipulation as part of a Message leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".

The weakness was presented 11/06/2019 (Website). The advisory is shared at cxf.apache.org. The identification of this vulnerability is CVE-2019-12406 since 05/28/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 3.2.11 or 3.3.4 eliminates this vulnerability.

See VDB-145134 for similar entry. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• CXF

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion