CVE

Id
70919  
CVE No.
CVE-2014-3623  
Status
Candidate  
Description
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
675555 70919 CVE-2014-3623 MLIST:[oss-security] 20141024 New security advisories released for Apache CXF  View
675556 70919 CVE-2014-3623 URL:http://seclists.org/oss-sec/2014/q4/437  View
675557 70919 CVE-2014-3623 CONFIRM:https://issues.apache.org/jira/browse/WSS-511  View
675558 70919 CVE-2014-3623 REDHAT:RHSA-2015:0236  View
675559 70919 CVE-2014-3623 URL:http://rhn.redhat.com/errata/RHSA-2015-0236.html  View
675560 70919 CVE-2014-3623 REDHAT:RHSA-2015:0675  View
675561 70919 CVE-2014-3623 URL:http://rhn.redhat.com/errata/RHSA-2015-0675.html  View
675562 70919 CVE-2014-3623 REDHAT:RHSA-2015:0850  View
675563 70919 CVE-2014-3623 URL:http://rhn.redhat.com/errata/RHSA-2015-0850.html  View
675564 70919 CVE-2014-3623 REDHAT:RHSA-2015:0851  View
675565 70919 CVE-2014-3623 URL:http://rhn.redhat.com/errata/RHSA-2015-0851.html  View
675566 70919 CVE-2014-3623 BID:70736  View
675567 70919 CVE-2014-3623 URL:http://www.securityfocus.com/bid/70736  View
675568 70919 CVE-2014-3623 SECUNIA:61909  View
675569 70919 CVE-2014-3623 URL:http://secunia.com/advisories/61909  View
675570 70919 CVE-2014-3623 XF:apache-cxf-cve20143623-sec-bypass(97754)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
15567 JVNDB-2014-004442 Linux Kernel の lib/assoc_array.c の associative-array の実装におけるサービス運用妨害 (DoS) の脆弱性 Linux Kernel の lib/assoc_array.c の associative-array の実装の assoc_array_gc 関数は、ガベージコレクションを適切に実装していないため、サービス運用妨害 (NULL ポインタデリファレンスおよびシステムクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-3631 70919 7.2 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004442.html  View