JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cxf | Apache | 3.0.0 (including) | 3.0.13 (including) |
| Cxf | Apache | 3.1.0 (including) | 3.1.11 (including) |
| Red Hat JBoss A-MQ 6.3 | RedHat | cxf | * |
| Red Hat JBoss Fuse 6.3 | RedHat | cxf | * |