Apache CXF OpenId Connect JWK Service Vulnerability to Key Exfiltration
CVE-2019-12423

7.5HIGH

Key Information:

Vendor

Apache
Status
Cxf
Vendor
CVE Published:
16 January 2020

What is CVE-2019-12423?

Apache CXF includes a service for OpenId Connect JWK keys that can inadvertently expose sensitive private and secret key credentials if a JWK keystore file is misconfigured. If the parameter 'rs.security.keystore.type' is set to 'jwk', all keys from the specified keystore, including confidential information, are returned in an unsecured manner. This vulnerability can lead to unauthorized access and manipulation of secure tokens, jeopardizing the integrity of the authentication process unless properly configured with aliases for keys.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CXF All versions of Apache CXF prior to 3.3.5 and 3.2.12.

References

https://lists.apache.org/thread.html/rd588ff96f18563aeb5f...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r36e44ffc1a9b365327d...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.