CVE-2022-46363
Fixed in a distro release EPSS 1%CVSS 7.5
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Products: Apache Software Foundation Apache CXF
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.cxf:cxf-core | 3.4.10 |
| Maven | org.apache.cxf:cxf-core | 3.5.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat jboss enterprise application platform eus 7.1 | eap7-apache-cxf | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-apache-cxf-rt | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-apache-cxf-services | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-apache-cxf-tools | 0:3.1.16-4.redhat_00003.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jackson-databind | 0:2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-jettison | 0:1.3.8-2.redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-netty | 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-netty-all | 0:4.1.63-1.Final_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-atom-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-cdi | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-client | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-crypto | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jackson-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jackson2-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jaxb-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jaxrs | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jettison-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jose-jwt | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-jsapi | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-json-p-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-multipart-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-spring | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-validator-provider-11 | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-resteasy-yaml-provider | 0:3.0.27-1.Final_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-snakeyaml | 0:1.33.0-1.SP1_redhat_00001.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-velocity | 0:1.7.0-3.redhat_00006.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly | 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.1 | eap7-wildfly-modules | 0:7.1.9-2.GA_redhat_00002.1.ep7.el7 |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-hal-console | 0:3.2.17-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-annotations | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-core | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-databind | 0:2.10.4-4.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-datatype-jdk8 | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-datatype-jsr310 | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-base | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-json-provider | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-jaxrs-providers | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-module-jaxb-annotations | 0:2.10.4-4.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-modules-base | 0:2.10.4-4.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jackson-modules-java8 | 0:2.10.4-2.redhat_00004.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-jettison | 0:1.5.2-2.redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-netty | 0:4.1.63-4.Final_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-netty-all | 0:4.1.63-4.Final_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-atom-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-cdi | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-client | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-client-microprofile | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-crypto | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jackson-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jackson2-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jaxb-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jaxrs | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jettison-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jose-jwt | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-jsapi | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-json-binding-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-json-p-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-multipart-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-rxjava2 | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-spring | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-validator-provider-11 | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-resteasy-yaml-provider | 0:3.11.6-1.Final_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-snakeyaml | 0:1.33.0-1.SP1_redhat_00001.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-java-jdk11 | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-java-jdk8 | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-javadocs | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
| Red Hat jboss enterprise application platform eus 7.3 | eap7-wildfly-modules | 0:7.3.12-3.GA_redhat_00002.1.el7eap |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.6-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.6-1.redhat_00001.1.el9sso |