CVE-2012-2379 Information

Description

Apache CXF 2.4.x before 2.4.8 2.5.x before 2.5.4 and 2.6.x before 2.6.1 when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy does not properly ensure that an XML element is signed or encrypted which has unspecified impact and attack vectors.

Reference

http://cxf.apache.org/cve-2012-2379.html http://rhn.redhat.com/errata/RHSA-2012-1559.html http://rhn.redhat.com/errata/RHSA-2012-1573.html http://rhn.redhat.com/errata/RHSA-2012-1591.html http://rhn.redhat.com/errata/RHSA-2012-1592.html http://rhn.redhat.com/errata/RHSA-2012-1593.html http://rhn.redhat.com/errata/RHSA-2012-1594.html http://rhn.redhat.com/errata/RHSA-2013-0191.html http://rhn.redhat.com/errata/RHSA-2013-0192.html http://rhn.redhat.com/errata/RHSA-2013-0193.html http://rhn.redhat.com/errata/RHSA-2013-0194.html http://rhn.redhat.com/errata/RHSA-2013-0195.html http://rhn.redhat.com/errata/RHSA-2013-0196.html http://rhn.redhat.com/errata/RHSA-2013-0197.html http://rhn.redhat.com/errata/RHSA-2013-0198.html http://secunia.com/advisories/51607 http://secunia.com/advisories/51984 http://svn.apache.org/viewvc?view=revision&revision=1338219 https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@3Ccommits.cxf.apache.org3E https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@3Ccommits.cxf.apache.org3E https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@3Ccommits.cxf.apache.org3E https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@3Ccommits.cxf.apache.org3E