oss-sec mailing list archives
[CVE-2019-12406] Apache CXF does not restrict the number of message attachments
From: Colm O hEigeartaigh <coheigea () apache org>
Date: Tue, 5 Nov 2019 15:53:54 +0000
[CVEID]:CVE-2019-12406 [PRODUCT]:Apache CXF [VERSION]:Apache CXF versions before 3.3.4 and 3.2.11 [PROBLEMTYPE]:Denial of Service [REFERENCES]: http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc [DESCRIPTION]:Apache CXF does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Current thread:
- [CVE-2019-12406] Apache CXF does not restrict the number of message attachments Colm O hEigeartaigh (Nov 05)