Description
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.
Published: 2020-01-16
Score: 7.5 High
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2020-0406 Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.
Github GHSA Github GHSA GHSA-42f2-f9vc-6365 Private key leak in Apache CXF
History

No history.

Subscriptions

Apache Cxf
Oracle Commerce Guided Search Communications Diameter Signaling Router Communications Element Manager Communications Session Report Manager Communications Session Route Manager Flexcube Private Banking Retail Order Broker
Redhat Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform Jboss Fuse Openshift Application Runtimes
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2024-08-04T23:17:40.033Z

Reserved: 2019-05-28T00:00:00.000Z

Link: CVE-2019-12423

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-01-16T18:15:11.400

Modified: 2024-11-21T04:22:48.770

Link: CVE-2019-12423

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-01-16T00:00:00Z

Links: CVE-2019-12423 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses