Loading vulnerability…
Apache CXF Symmetric EncryptBeforeSigning UsernameToken Cleartext Exposure
CVE-2014-0035 is an information-disclosure vulnerability in Apache CXF clients before 2.6.13 and 2.7.x before 2.7.10. When a client uses a SymmetricBinding with EncryptBeforeSigning enabled and configures its UsernameToken policy as an EncryptedSupportingToken, CXF transmits the UsernameToken in plaintext rather than encrypting it. SignBeforeEncrypting configurations and other binding types are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An on-path attacker able to observe affected client traffic can recover the UsernameToken credentials, including the username and password, used by the client application. The direct impact is confidentiality loss of authentication credentials; the recovered credentials may enable subsequent unauthorized access to services that accept them.
If you can’t patch tonight, do this now.
Until updates are deployed, avoid the vulnerable policy combination: do not use SymmetricBinding with EncryptBeforeSigning and a UsernameToken configured as an EncryptedSupportingToken. Use SignBeforeEncrypting where compatible, as it is not affected. Limit opportunities for traffic interception through protected network paths and transport-layer encryption.
Patch, then assume compromise.
Upgrade Apache CXF to 2.6.13 or later on the 2.6 branch, or 2.7.10 or later on the 2.7 branch. Upgrading to 2.6.14 or later, or 2.7.11 or later, is recommended to incorporate additional security fixes. Apply the applicable vendor update for products bundling Apache CXF, including affected Red Hat JBoss distributions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.