CVE-2012-5575
Summary
| CVE | CVE-2012-5575 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-08-19 23:55:00 UTC |
| Updated | 2023-02-13 04:37:00 UTC |
| Description | Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." |
Risk And Classification
Problem Types: CWE-310
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Cxf | 2.5.0 | All | All | All |
| Application | Apache | Cxf | 2.5.1 | All | All | All |
| Application | Apache | Cxf | 2.5.2 | All | All | All |
| Application | Apache | Cxf | 2.5.3 | All | All | All |
| Application | Apache | Cxf | 2.5.4 | All | All | All |
| Application | Apache | Cxf | 2.5.5 | All | All | All |
| Application | Apache | Cxf | 2.5.6 | All | All | All |
| Application | Apache | Cxf | 2.5.7 | All | All | All |
| Application | Apache | Cxf | 2.5.8 | All | All | All |
| Application | Apache | Cxf | 2.5.9 | All | All | All |
| Application | Apache | Cxf | 2.6.0 | All | All | All |
| Application | Apache | Cxf | 2.6.1 | All | All | All |
| Application | Apache | Cxf | 2.6.2 | All | All | All |
| Application | Apache | Cxf | 2.6.3 | All | All | All |
| Application | Apache | Cxf | 2.6.4 | All | All | All |
| Application | Apache | Cxf | 2.6.5 | All | All | All |
| Application | Apache | Cxf | 2.6.6 | All | All | All |
| Application | Apache | Cxf | 2.7.0 | All | All | All |
| Application | Apache | Cxf | 2.7.1 | All | All | All |
| Application | Apache | Cxf | 2.7.2 | All | All | All |
| Application | Apache | Cxf | 2.7.3 | All | All | All |
| Application | Apache | Cxf | 2.5.0 | All | All | All |
| Application | Apache | Cxf | 2.5.1 | All | All | All |
| Application | Apache | Cxf | 2.5.2 | All | All | All |
| Application | Apache | Cxf | 2.5.3 | All | All | All |
| Application | Apache | Cxf | 2.5.4 | All | All | All |
| Application | Apache | Cxf | 2.5.5 | All | All | All |
| Application | Apache | Cxf | 2.5.6 | All | All | All |
| Application | Apache | Cxf | 2.5.7 | All | All | All |
| Application | Apache | Cxf | 2.5.8 | All | All | All |
| Application | Apache | Cxf | 2.5.9 | All | All | All |
| Application | Apache | Cxf | 2.6.0 | All | All | All |
| Application | Apache | Cxf | 2.6.1 | All | All | All |
| Application | Apache | Cxf | 2.6.2 | All | All | All |
| Application | Apache | Cxf | 2.6.3 | All | All | All |
| Application | Apache | Cxf | 2.6.4 | All | All | All |
| Application | Apache | Cxf | 2.6.5 | All | All | All |
| Application | Apache | Cxf | 2.6.6 | All | All | All |
| Application | Apache | Cxf | 2.7.0 | All | All | All |
| Application | Apache | Cxf | 2.7.1 | All | All | All |
| Application | Apache | Cxf | 2.7.2 | All | All | All |
| Application | Apache | Cxf | 2.7.3 | All | All | All |
| Application | Redhat | Jboss Enterprise Application Platform | 5.0.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Application Platform | 5.0.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Portal Platform | 4.3.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Portal Platform | 4.3.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Soa Platform | 4.3.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Soa Platform | 4.3.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Web Platform | 5.2.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Web Platform | 5.2.0 | All | All | All |
| Application | Redhat | Jboss Fuse Esb Enterprise | 7.1.0 | All | All | All |
| Application | Redhat | Jboss Fuse Esb Enterprise | 7.1.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Apache CXF -- CVE-2012-5575 | CONFIRM | cxf.apache.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| 880443 – (CVE-2012-5575) CVE-2012-5575 jbossws-native, jbossws-cxf, apache-cxf: XML encryption backwards compatibility attacks | CONFIRM | bugzilla.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| JBoss Enterprise Application Platform CVE-2012-5575 Information Disclosure Vulnerability | BID | www.securityfocus.com | |
| Pony Mail! | MISC | lists.apache.org | |
| lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0... | MISC | lists.apache.org | |
| Veröffentlichungen - Ruhr-Universität Bochum | MISC | www.nds.ruhr-uni-bochum.de | |
| lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da3651... | MISC | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| RHSA-2013:1143 | REDHAT | rhn.redhat.com | Vendor Advisory |
| Pony Mail! | MISC | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| RHSA-2013:0943 | REDHAT | rhn.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| RHSA-2013:0876 | REDHAT | rhn.redhat.com | Vendor Advisory |
| Pony Mail! | MISC | lists.apache.org | |
| Pony Mail! | MISC | lists.apache.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.