CVE-2014-0035

Published: Jul 7, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected (25)

Products: Apache: Cxf · Redhat: Jboss Enterprise Application Platform

1 product

1 product

Jboss Enterprise Application Platform

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Up to 2.6.12
Apache Cxf	Version 2.6.0
Apache Cxf	Version 2.6.10
Apache Cxf	Version 2.6.11
Apache Cxf	Version 2.6.1
Apache Cxf	Version 2.6.2
Apache Cxf	Version 2.6.3
Apache Cxf	Version 2.6.4
Apache Cxf	Version 2.6.5
Apache Cxf	Version 2.6.6
Apache Cxf	Version 2.6.7
Apache Cxf	Version 2.6.8
Apache Cxf	Version 2.6.9

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Version 2.7.0
Apache Cxf	Version 2.7.1
Apache Cxf	Version 2.7.2
Apache Cxf	Version 2.7.3
Apache Cxf	Version 2.7.4
Apache Cxf	Version 2.7.5
Apache Cxf	Version 2.7.6
Apache Cxf	Version 2.7.7
Apache Cxf	Version 2.7.8
Apache Cxf	Version 2.7.9

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.2.0

Related CWEs

References (28)

http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc

Source: secalert@redhat.com

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2014-0797.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0798.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0799.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-1351.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0850.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0851.html

Source: secalert@redhat.com

http://svn.apache.org/viewvc?view=revision&revision=1564724

Source: secalert@redhat.com

Patch

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Source: secalert@redhat.com

http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2014-0797.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0798.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-0799.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2014-1351.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-0850.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2015-0851.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.apache.org/viewvc?view=revision&revision=1564724

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.