Colm O Heigeartaigh

An incomplete fix for a previous issue allows for remote code execution if untrusted users are permitted to configure the Java Message Service (JMS), a Java API that allows applications to create, send, receive, and read messages.

An LDAP injection issue exists in the LDAP Certificate repository of the XKMS server. This allows an attacker to retrieve arbitrary certificates from the repository. LDAP injection is a technique where malicious LDAP statements are used to manipulate queries sent to a directory server.

The PolicyReference API does not impose restrictions on URIs when manually fetching remote policy references. This allows an application that explicitly calls the API to make outbound requests using arbitrary protocols and internal IP addresses.

Apache Neethi fails to properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (for example, Policy A references Policy B, which in turn references Policy A), the policy normalization process may enter an infinite loop or cause excessive recursion. This can result in a stack overflow or an application hang, allowing an attacker to cause a Denial of Service condition by crafting malicious policy documents.

An issue exists in policy normalization where algorithmic complexity allows for a Denial of Service attack. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process. This results in unbounded memory allocation that exhausts the JVM heap because the process generates an excessive number of policy alternatives without limits.

A potential denial of service issue is present in Apache CXF. In some edge cases, the `CachedOutputStream` instances may not be closed and, if backed by temporary files, may fill up the file system. This issue applies to both servers and clients. An exploit can cause resource exhaustion, resulting in a denial of service.

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 3.6.3 and earlier, 4.0.4 and earlier Description: The issue is related to a memory leak in the Apache CXF HTTP client conduit, which can prevent HTTPClient instances from being garbage collected. This can cause memory consumption to increase over time, potentially leading to the application running out of memory. The vulnerability can be exploited by a remote attacker to cause a denial of service. Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. For versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HTTP client conduit to minimize the risk of exploitation.

The issue concerns JMX authentication and authorization in Karaf, where a user with a "viewer" role can invoke certain methods, potentially leading to a SSRF style attack and privilege escalation by polluting the MBean registry. By default, only an "admin" can invoke on an MBean, but a "viewer" role can call get* methods. An attacker can authenticate as a "viewer" and invoke the MLet `getMBeansFromURL` method, which fetches an MBean from a remote server and registers it in Karaf. Although the attack fails due to lack of permission to invoke on the MBean, it can still cause issues. The vulnerability can be mitigated by adding an ACL to limit access.

A vulnerability exists in Apache Flink where an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data. The attack is possible when running a process with an enabled JMXReporter, with a port configured via `metrics.reporter.reporter name>.port`.

Name of the Vulnerable Software and Affected Versions: Apache Karaf versions prior to 4.2.3 Description: The issue arises from the Apache Karaf kar deployer's failure to validate paths in .kar archives, allowing a malicious user to craft a .kar file with ".." directory names and write arbitrary content to the filesystem, known as the "Zip-slip" vulnerability. The impact of this issue is mitigated if the Karaf process user has limited permission on the filesystem. Recommendations: For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting the permissions of the Karaf process user on the filesystem to minimize the risk of exploitation.

The issue concerns the improper encoding of usernames, making the system vulnerable to LDAP injection attacks. This can lead to a denial of service.

The issue allows remote attackers to cause a denial of service. This can be achieved through application plugins in Apache CXF Fediz.

The issue is related to the application plugins in Apache CXF Fediz, where SAML AudienceRestriction values are not properly matched against configured audience URIs. This could allow remote attackers to bypass intended restrictions by using a crafted SAML token with a trusted signature.

The issue allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a wrapping attack.

The issue is related to errors in security settings of the Hawtio web console in Apache ActiveMQ, which allows CORS headers to be set to allow all in Red Hat AMQ. This could potentially allow a remote attacker to obtain confidential information or exert other influence.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, via crafted Document Type Definitions (DTDs) when applying Transforms, related to signatures. This is due to errors in resource management.

The issue allows remote attackers to bypass authentication when the plaintext UsernameToken WS-SecurityPolicy is enabled. This occurs via a security header of a SOAP request containing a `UsernameToken` element that lacks a `password` child element.