8.1

CVE-2018-8039: apache software foundation apache cxf

CVSS: 8.1v3.0HighModified
AliasesGHSA-jc7r-v6fg-2gpf
Published 02-07-2018Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2018-8039 is a high (CVSS 8.1) vulnerability in apache software foundation apache cxf. EPSS estimates a 8.51% chance of exploitation in the next 30 days, higher than 94.9% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.0 (NVD)
EPSS score
8.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4
RHSA-2018:2276RHSA-2018:2423RHSA-2018:2424RHSA-2018:2643

Timeline

  1. 02-07-2018
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

8.51%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.51% on 18-09-2026

18-09-202618-10-2026
EPSS score
8.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Org.apache.cxf2 products
  • apache-cxf≥ 3.2.0, < 3.2.5 | < 3.1.16
  • cxf-rt-transports-http≥ 3.2.0, < 3.2.5 | < 3.1.16
Apache1 product
  • cxf< 3.1.16 | ≥ 3.2.0, < 3.2.5
Apache software foundation1 product
Redhat1 product

4 vendors · 5 products

References

36 links
Show all 36 references