NVD

Id
46694  
Name
CVE-2012-5575  
Description
Apache CFX 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2013-08-19  
Modified Date
2013-10-30  
Seq
2012-5575  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
233917 46694 CVE-2012-5575 http://cxf.apache.org/cve-2012-5575.html  View
233918 46694 CVE-2012-5575 RHSA-2013:0833  View
233919 46694 CVE-2012-5575 RHSA-2013:0834  View
233920 46694 CVE-2012-5575 RHSA-2013:0839  View
233921 46694 CVE-2012-5575 RHSA-2013:0873  View
233922 46694 CVE-2012-5575 RHSA-2013:0874  View
233923 46694 CVE-2012-5575 RHSA-2013:0875  View
233924 46694 CVE-2012-5575 RHSA-2013:0876  View
233925 46694 CVE-2012-5575 RHSA-2013:0943  View
233926 46694 CVE-2012-5575 RHSA-2013:1028  View
233927 46694 CVE-2012-5575 RHSA-2013:1143  View
233928 46694 CVE-2012-5575 RHSA-2013:1437  View
233929 46694 CVE-2012-5575 http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/  View
233930 46694 CVE-2012-5575 60043  View
233931 46694 CVE-2012-5575 https://bugzilla.redhat.com/show_bug.cgi?id=880443  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22216 JVNDB-2013-003791 Apache CXF における脆弱な暗号化アルゴリズムを使用するように強制される脆弱性 Apache CXF は、復号の前に WS-SecurityPolicy の AlgorithmSuite 定義により許可された指定の暗号化アルゴリズムが有効であるかどうか検証しないため、CXF が意図しない脆弱な暗号化アルゴリズムを使用するように強制され、容易に通信を復号 (decrypt communication) される脆弱性が存在します。 CVE-2012-5575 58813 CVE-2012-5575 46694 6.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003791.html 2013-05-28 2013-11-21 View