CVE-2018-8039

Impact:
Important
Public Date:
2018-06-29
CWE:
CWE-248
Bugzilla:
1595332: CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*
It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in the reflection code but it is not properly propagated, this can lead to a man-in-the-middle attack.

Find out more about CVE-2018-8039 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 6.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Impact Low
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts (rhvm-appliance) RHSA-2018:2643 2018-09-04
Red Hat JBoss EAP 7.1 RHSA-2018:2277 2018-07-26
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server RHSA-2018:2424 2018-08-15
Red Hat JBoss Fuse 6.3 RHSA-2018:3817 2018-12-11
Red Hat JBoss EAP 7.1 RHSA-2018:2425 2018-08-15
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server RHSA-2018:2423 2018-08-15
Red Hat JBoss Fuse 7 RHSA-2018:3768 2018-12-04
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server (eap7-apache-cxf) RHSA-2018:2276 2018-07-26
Red Hat Single Sign-On 7.2 RHSA-2018:2279 2018-07-26
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server (eap7-apache-cxf) RHSA-2018:2276 2018-07-26
Red Hat Single Sign-On 7.2 RHSA-2018:2428 2018-08-15
Red Hat JBoss A-MQ 6.3 RHSA-2018:3817 2018-12-11

Affected Packages State

Platform Package State
Red Hat Virtualization 4 eap7-apache-cxf Affected
Red Hat Single Sign-On 7 cxf-core Affected
Red Hat OpenShift Application Runtimes 1.0 springboot Affected
Red Hat JBoss EAP 6 cxf-core Not affected
Red Hat JBoss Data Virtualization 6 cxf-core Under investigation
Red Hat JBoss BRMS 6 cxf Affected
Red Hat JBoss BPMS 6 cxf-core Affected

External References

Last Modified