Description
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Published: 2013-08-19
Score: 6.4 Medium
EPSS: 9.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7v5v-9v8r-w864 Inadequate Encryption Strength in Apache CXF
References
Link Providers
http://cxf.apache.org/cve-2012-5575.html cve-icon cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0833.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0834.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0839.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0873.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0874.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0875.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0876.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-0943.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-1028.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-1143.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2013-1437.html cve-icon cve-icon
http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/ cve-icon cve-icon cve-icon
http://www.securityfocus.com/bid/60043 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=880443 cve-icon cve-icon
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2012-5575 cve-icon
https://www.cve.org/CVERecord?id=CVE-2012-5575 cve-icon
History

No history.

Subscriptions

Apache Cxf
Redhat Fuse Esb Enterprise Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform Jboss Enterprise Soa Platform Jboss Enterprise Web Platform Jboss Fuse Esb Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T21:14:16.301Z

Reserved: 2012-10-24T00:00:00.000Z

Link: CVE-2012-5575

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2013-08-19T23:55:08.127

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-5575

cve-icon Redhat

Severity : Important

Publid Date: 2013-03-08T00:00:00Z

Links: CVE-2012-5575 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses