4.1.0
11 years ago
13 days ago
Known vulnerabilities in the org.apache.cxf:cxf-core package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) as the NOTE
This vulnerability exists when using How to fix Server-side Request Forgery (SSRF)? Upgrade | [,3.4.10)[3.5.0,3.5.5) |
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Denial of Service (DoS). Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property attachment-max-header-size. How to fix Denial of Service (DoS)? Upgrade | [,3.1.14)[3.2.0,3.2.1) |