----BEGIN PGP SIGNED MESSAGE----
Hash: SHA1

CVE-2012-0803: Apache CXF does not validate UsernameToken policies correctly

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache CXF 2.4.5 and 2.5.1

Description: CXF does not validate a WS-Security UsernameToken received as part
of the security header of a SOAP request against a WS-SP UsernameToken policy.

A malicious client could send a request to the endpoint with no UsernameToken,
and the UsernameToken policy requirement would still be marked as valid.

This has been fixed in revision:

http://svn.apache.org/viewvc?view=revision&revision=1233457

This issue was a regression in CXF 2.4.5 and 2.5.1. The vulnerability does not
exist in CXF 2.4.4 and 2.5.0.

Migration:

CXF 2.4.5 users should upgrade to 2.4.6 as soon as possible.
CXF 2.5.1 users should upgrade to 2.5.2 as soon as possible.

References: http://cxf.apache.org/security-advisories.html

----BEGIN PGP SIGNATURE----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJPMAVXAAoJEGe/gLEK1TmD6y0H/2aP3A02qoFKeV0oYj7y8BCv
yPymkAilG6RLZK3kafZREnQ2jY/lCT0xXNP5n+0TYEu56WuS5tGzAeWpQc1TFmbi
Uq0YTv5RM3TZZ8lzThid+ean1qBU9LuIziQqKWP0QRpw+UipUHq68jTGkAOMePId
IbXnyogUy0si3jpI7BCnMsDOR8fGx9+t35D5jfcVf4aH+jFP1W4DhjeFbDhMlvSF
8Z4Pphvd7yi6x469dx0e46cGLaGi/BYyG3C2IrMOAmUXBcYB3g3skZN1nrY1t90n
IB12w03xishiAZVNs9FsfR3lAa84zX8z7+hrqb8Rlra1evhJBXQ/L583bmMmxKc=
=iU+M
----END PGP SIGNATURE----