CVE-2014-0035
Fixed in a distro release EPSS 7%
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Products: apache cxf, redhat jboss_enterprise_application_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.cxf:cxf-core | 2.6.13 |
| Maven | org.apache.cxf:cxf-core | 2.7.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform 6 | apache-cxf | 0:2.7.11-3.redhat_3.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | apache-cxf | 0:2.7.11-3.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | hibernate4-core-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | hibernate4-core-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | hibernate4-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | hibernate4-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | hibernate4-entitymanager-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | hibernate4-entitymanager-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | hibernate4-envers-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | hibernate4-envers-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | hibernate4-infinispan-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | hibernate4-infinispan-eap6 | 0:4.2.7-9.SP5_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-aesh | 0:0.33.12-1.redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-aesh | 0:0.33.12-1.redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-appclient | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-appclient | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-cli | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-cli | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-client-all | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-client-all | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-clustering | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-clustering | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-cmp | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-cmp | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-configadmin | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-configadmin | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-connector | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-connector | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-controller-client | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-controller-client | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-core-security | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-core-security | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-deployment-repository | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-deployment-repository | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-deployment-scanner | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-deployment-scanner | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-domain-http | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-domain-http | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-domain-management | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-domain-management | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ee | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ee | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ee-deployment | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ee-deployment | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ejb3 | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-ejb3 | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-embedded | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-embedded | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-host-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-host-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jacorb | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jacorb | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jaxr | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jaxr | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jaxrs | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jaxrs | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jdr | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jdr | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jmx | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jmx | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jpa | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jpa | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jsf | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jsf | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jsr77 | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-jsr77 | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-logging | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-logging | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-mail | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-mail | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-management-client-content | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-management-client-content | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-messaging | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-messaging | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-modcluster | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-modcluster | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-naming | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-naming | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-network | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-network | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi-configadmin | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi-configadmin | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi-service | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-osgi-service | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-platform-mbean | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-platform-mbean | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-pojo | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-pojo | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-process-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-process-controller | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-protocol | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-protocol | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-remoting | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-remoting | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-sar | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-sar | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-security | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-security | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-server | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-server | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-system-jmx | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-system-jmx | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-threads | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-threads | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-transactions | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-transactions | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-version | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-version | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-web | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-web | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-webservices | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-webservices | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-weld | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-weld | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-as-xts | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-as-xts | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-security-negotiation | 0:2.2.10-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-security-negotiation | 0:2.2.10-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jboss-xnio-base | 0:3.0.10-1.GA_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jboss-xnio-base | 0:3.0.10-1.GA_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-appclient | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-appclient | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-bundles | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-bundles | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-core | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-core | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-domain | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-domain | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-javadocs | 0:7.3.4-1.Final_redhat_1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-javadocs | 0:7.3.4-1.Final_redhat_1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-modules-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-modules-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-product-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-product-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-standalone | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossas-standalone | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-welcome-content-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossas-welcome-content-eap | 0:7.3.4-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossts | 1:4.17.15-5.Final_redhat_5.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | jbossts | 1:4.17.15-5.Final_redhat_5.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossweb | 0:7.3.2-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | jbossweb | 0:7.3.2-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | picketbox | 0:4.0.19-8.SP8_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | picketbox | 0:4.0.19-8.SP8_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | resteasy | 0:2.3.7.2-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | resteasy | 0:2.3.7.2-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | weld-core | 0:1.1.17-4.SP3_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | weld-core | 0:1.1.17-4.SP3_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise application platform 6 | wss4j | 0:1.6.15-1.redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | wss4j | 0:1.6.15-1.redhat_1.1.ep6.el6 |