Fluid Attacks Database

Description

Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2 Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	org.apache.cxf.fediz:fediz-spring2	>=1.3.0 <1.3.2 \|\| >=0 <1.2.4	1.3.2, 1.2.4
maven	org.apache.cxf.fediz:fediz-jetty8	>=0 <1.3.2	1.3.2
maven	org.apache.cxf.fediz:fediz-jetty9	>=0 <1.3.2	1.3.2
maven	org.apache.cxf.fediz:apache-fediz	=1.2.4 \|\| >=1.3.2 <=1.4.0	1.3.0, 1.4.1

Aliases

1. CVE-2017-76612. NVD-2017-76613. OSV-2017-76614. GHSA-whw7-h25v-9qvx5. GCVE-2017-76616. CXF-CVE-2017-7661.txt.asc

References

1. https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E2. https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E3. https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E4. https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E5. https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E6. https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E7. http://cxf.apache.org/security-advisories.data/CVE-2017-7661.txt.asc8. http://www.securitytracker.com/id/10384979. https://github.com/dawetmaster/CVE-2017-7661-cxf-fediz-vulnerable