CVE-2024-32007

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32007", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-04-08T15:34:17.712Z", "datePublished": "2024-07-19T08:50:31.832Z", "dateUpdated": "2024-09-13T17:04:44.644Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "org.apache.cxf.rs.security.jose", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.0.5, 3.6.4, 3.5.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An improper input validation of the&nbsp;p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9&nbsp;allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.&nbsp;<br>"}], "value": "An improper input validation of the\u00a0p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9\u00a0allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.\u00a0\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-19T08:50:31.832Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache CXF Denial of Service vulnerability in JOSE", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "apache", "product": "cxf", "cpes": ["cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.0.5", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "3.6.4", "versionType": "semver"}, {"version": "0", "status": "affected", "lessThan": "3.5.9", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-19T17:00:33.143276Z", "id": "CVE-2024-32007", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T17:02:50.657Z"}}, {"title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"}, {"url": "https://security.netapp.com/advisory/ntap-20240808-0009/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/18/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-13T17:04:44.644Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240808-0009/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/07/18/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-13T17:04:44.644Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-32007", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-19T17:00:33.143276Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "cxf", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.5", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.4", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.5.9", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T17:02:19.334Z"}}], "cna": {"title": "Apache CXF Denial of Service vulnerability in JOSE", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab."}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.5, 3.6.4, 3.5.9", "versionType": "semver"}], "packageName": "org.apache.cxf.rs.security.jose", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper input validation of the\u00a0p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9\u00a0allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.\u00a0\n", "supportingMedia": [{"type": "text/html", "value": "An improper input validation of the&nbsp;p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9&nbsp;allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.&nbsp;<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-07-19T08:50:31.832Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32007", "state": "PUBLISHED", "dateUpdated": "2024-09-13T17:04:44.644Z", "dateReserved": "2024-04-08T15:34:17.712Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-07-19T08:50:31.832Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.apache.cxf.rs.security.jose", "product": "Apache CXF", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.0.5, 3.6.4, 3.5.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "cxf", "vendor": "apache", "versions": [{"lessThan": "4.0.5", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "3.5.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF0BA29F-721E-4599-A7AC-32DAC5AB44D5", "versionEndExcluding": "3.5.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D6F6603-DD23-4DD5-8B90-0BAB0EB7E1D1", "versionEndExcluding": "3.6.4", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACAFECF5-75A5-4397-A588-F51D09717335", "versionEndExcluding": "4.0.5", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper input validation of the\u00a0p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9\u00a0allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.\u00a0\n"}, {"lang": "es", "value": " Una validaci\u00f3n de entrada incorrecta del par\u00e1metro p2c en el c\u00f3digo Apache CXF JOSE anterior a 4.0.5, 3.6.4 y 3.5.9 permite a un atacante realizar un ataque de denegaci\u00f3n de servicio especificando un valor grande para este par\u00e1metro en un token."}], "id": "CVE-2024-32007", "lastModified": "2026-06-17T07:29:06.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-32007", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-19T17:00:33.143276Z", "version": "2.0.3"}}]}, "published": "2024-07-19T09:15:04.713", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2024/07/18/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240808-0009/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:6883", "cpe": "cpe:/a:redhat:apache_camel_spring_boot:3.20.7", "package": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "release_date": "2024-09-19T00:00:00Z"}, {"advisory": "RHSA-2024:2707", "cpe": "cpe:/a:redhat:apache-camel-spring-boot:4.4.0", "product_name": "Red Hat build of Apache Camel 4.4.0 for Spring Boot", "release_date": "2024-05-06T00:00:00Z"}, {"advisory": "RHSA-2024:7052", "cpe": "cpe:/a:redhat:camel_quarkus:3.8", "package": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3", "release_date": "2024-09-24T00:00:00Z"}], "bugzilla": {"description": "apache: cxf: org.apache.cxf:cxf-rt-rs-security-jose: Denial of Service vulnerability in JOSE", "id": "2298828", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298828"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "(CWE-20|CWE-400)", "details": ["An improper input validation of the\u00a0p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9\u00a0allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.\u00a0", "An improper input validation vulnerability was found in the p2c parameter in the Apache CXF JOSE. This flaw allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-32007", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Affected", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat build of Apache Camel for Spring Boot 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Will not fix", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Will not fix", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "org.apache.cxf/cxf-rt-rs-security-jose", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2024-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-32007\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-32007\nhttps://github.com/advisories/GHSA-6pff-fmh2-4mmf\nhttps://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"], "statement": "The improper input validation vulnerability in the p2c parameter of Apache CXF JOSE is considered a moderate severity issue rather than a important one due to its limited scope and impact. While the flaw allows an attacker to specify a large value for the p2c parameter, leading to potential denial of service (DoS) attacks by causing excessive computational overhead, it does not compromise data integrity, confidentiality, or authentication mechanisms directly. The attack vector primarily affects system availability and exploiting this vulnerability requires the ability to send crafted tokens.\nBase EAP (7.4 and 8) and EAP XP (4 and 5) do not ship this affected CXF jaxrs artifact. cxf-rt-rs-security-jose is part of CXF's JAX-RS, and EAP uses RESTEasy, hence it's not-affected.", "threat_severity": "Moderate"}

{}