> Apache CXF 资源管理错误漏洞

Apache CXF 资源管理错误漏洞

CNNVD-ID编号	CNNVD-201911-332	CVE编号	CVE-2019-12406
发布时间	2019-11-06	更新时间	2021-01-21
漏洞类型	资源管理错误	漏洞来源	N/A
危险等级	中危	威胁类型	远程
厂商	N/A

漏洞介绍

Apache CXF是美国阿帕奇（Apache）软件基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。

Apache CXF 3.3.4之前版本和3.2.11之前版本中存在安全漏洞，该漏洞源于程序没有限制消息中的附件数。攻击者可借助含有大量附件的消息利用该漏洞造成拒绝服务。

漏洞补丁

目前厂商已发布升级了Apache CXF 资源管理错误漏洞的补丁，Apache CXF 资源管理错误漏洞的补丁获取链接：

http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc

参考网址

来源:MLIST

链接：https://lists.apache.org/thread.html/rb2a6dab1f781f55326543c56dc29ea677759439ddfeba920c83037e6@%3Cissues.cxf.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/r92238967ba2783d3ab5a483f2e17f5fdaa8ace98990f69f9e8e15de0@%3Cissues.cxf.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E

来源:N/A

链接：https://www.oracle.com/security-alerts/cpuapr2020.html

来源:MLIST

链接：https://lists.apache.org/thread.html/rca465c9d1e1969281338522b76701c85a07abd045c494261137236e0@%3Cissues.cxf.apache.org%3E

来源:MISC

链接：https://www.oracle.com/security-alerts/cpujan2020.html

来源:MLIST

链接：https://lists.apache.org/thread.html/rabc395b38acb7f2465bfbf0bc16d6e1e95720c89bea87abe8808eeea@%3Cissues.cxf.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E

来源:www.ibm.com

链接：https://www.ibm.com/support/pages/node/1288774

来源:www.ibm.com

链接：https://www.ibm.com/support/pages/node/2404149

来源:www.ibm.com

链接：https://www.ibm.com/support/pages/node/2404155

来源:www.ibm.com

链接：https://www.ibm.com/support/pages/node/2404161

来源:access.redhat.com

链接：https://access.redhat.com/errata/RHSA-2020:0556

来源:cxf.apache.org

链接：http://cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc

来源:cxf.apache.org

链接：http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-application-server-liberty-affect-bm-spectrum-control-cve-2019-17573-cve-2019-12406/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-cxf-affects-ibm-cloud-app-management-cve-2019-12406/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-apache-cxf-publicly-disclosed-vulnerability/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-has-been-identified-in-ibm-websphere-application-server-shipped-with-ibm-tivoli-netcool-impact-cve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1019/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/160562/Red-Hat-Security-Advisory-2020-5568-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0518/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-websphere-liberty-server-shipped-with-ibm-global-mailbox/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-liberty-affects-ibm-waston-machine-learning-accelerator/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-liberty-for-java-for-ibm-cloudcve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0401/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-novalink-is-impacted-apache-cxf-affects-middle-vulnerability-in-websphere-application-server-liberty-cve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.4464/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0564/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-websphere-application-server-that-is-installed-with-ibm-spss-analytic-server-cve-2019-12406/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache-cfx-affects-the-ibm-performance-management-product-cve-2019-12406/

来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/Apache-CXF-denial-of-service-via-Large-Number-Of-Message-Attachments-31502

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-rational-asset-analyzer-is-affected-by-a-vulnerability-in-websphere-application-server/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-management-is-vulnerable-to-open-redirection-vulnerabilities-arise-when-an-application-incorporates-user-controllable-data-into-the-target-of-a-redirection-in/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-asset-analyzer-raa-is-affected-by-a-websphere-application-server-vulnerability-4/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-websphere-denial-of-service-vulnerability-affects-ibm-control-center-cve-2019-12406/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-websphere-application-server-liberty-cve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0590/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.2619/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-websphere-liberty-server-wlp-affects-ibm-cloud-application-business-insights/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1766/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-websphere-application-server-cve-2019-12406/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157741/Red-Hat-Security-Advisory-2020-2067-01.html

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-information-server-is-affected-by-multiple-vulnerabilities-in-websphere-application-server-liberty/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-private-is-vulnerable-to-an-ibm-websphere-application-server-liberty-vulnerability-cve-2019-12406/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/158651/Red-Hat-Security-Advisory-2020-3197-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0816/

来源:nvd.nist.gov

链接：https://nvd.nist.gov/vuln/detail/CVE-2019-12406

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-cxf-affects-websphere-application-server-cve-2019-12406-2/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerability-in-ibm-websphere-application-server-affects-ibm-voice-gateway-2/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-the-apache-cxf-library-used-in-websphere-application-server-liberty-core-affect-cics-transaction-gateway/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.2254/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-event-streams-is-affected-by-apache-cxf-vulnerability-cve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2019.4157/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-watson-explorer-cve-2019-4720-cve-2019-12406/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-websphere-application-server-liberty-affects-ibm-spectrum-protect-operations-center-and-client-management-service-cve-2019-12406/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1284/

来源:www.nsfocus.net

链接：http://www.nsfocus.net/vulndb/47122

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1644/

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201911-332