[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGBm757d8SziB_s6rrhj_rURRSWnLU08MbvYLYPdV02S2A@mail.gmail.com>
Date: Mon, 22 Dec 2014 12:00:28 +0000
From: Colm O hEigeartaigh <coheigea@...che.org>
To: "users@....apache.org" <users@....apache.org>, "dev@....apache.org" <dev@....apache.org>,
Apache Security Response Team <security@...che.org>, oss-security@...ts.openwall.com,
bugtraq@...urityfocus.com
Subject: New SSL/TLS vulnerabilities in Apache CXF
Two new security vulnerabilities are announced in Apache CXF that are fixed
in the latest 3.0.3 and 2.7.14 releases:
a) Note on CVE-2014-3566 - SSL 3.0 support in Apache CXF, aka the "POODLE"
attack
b) CVE-2014-3577: Apache CXF SSL hostname verification bypass
Both advisories are available here:
http://cxf.apache.org/security-advisories.html
Colm.
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
