CoreCVE
Back

MEDIUM

Apache CXF Denial of Service vulnerability in JOSE

Published Jul 19, 2024

Description

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Affected products

Remediation

Red Hat statement

The improper input validation vulnerability in the p2c parameter of Apache CXF JOSE is considered a moderate severity issue rather than a important one due to its limited scope and impact. While the flaw allows an attacker to specify a large value for the p2c parameter, leading to potential denial of service (DoS) attacks by causing excessive computational overhead, it does not compromise data integrity, confidentiality, or authentication mechanisms directly. The attack vector primarily affects system availability and exploiting this vulnerability requires the ability to send crafted tokens. Base EAP (7.4 and 8) and EAP XP (4 and 5) do not ship this affected CXF jaxrs artifact. cxf-rt-rs-security-jose is part of CXF's JAX-RS, and EAP uses RESTEasy, hence it's not-affected.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (3)

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Jul 19, 2024
Updated Sep 13, 2024
Reserved Apr 8, 2024
Link CVE-2024-32007
CISA Vulnrichment
Updated Jul 19, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2024-32007
Red Hat
Severity Moderate
Public date Jul 19, 2024
Links CVE-2024-32007 - Bugzilla
GHSA-6PFF-FMH2-4MMF