[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAB8XdGDhO0XWJCOZZH-5rkWNc9B06Y-HWgEfd9602ijDZJa=WA@mail.gmail.com>
Date: Thu, 18 Jul 2024 16:49:25 +0100
From: Colm O hEigeartaigh <coheigea@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-32007: Apache CXF Denial of Service vulnerability in JOSE
CVE-2024-32007: Apache CXF Denial of Service vulnerability in JOSE
Severity: moderate
Affected versions:
- Apache CXF before 4.0.5, 3.6.4, 3.5.9
Description:
An improper input validation of the p2c parameter in the Apache CXF
JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform
a denial of service attack by specifying a large value for this
parameter in a token.
Credit:
Jingcheng Yang and Jianjun Chen from Sichuan University and
Zhongguancun Lab. (finder)
References:
https://cxf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-32007
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
