{
  "threat_severity" : "Important",
  "public_date" : "2019-11-06T00:00:00Z",
  "bugzilla" : {
    "description" : "cxf: OpenId Connect token service does not properly validate the clientId",
    "id" : "1816175",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1816175"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-287",
  "details" : [ "Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.", "A flaw was found in cxf in versions prior to 3.2.11 and 3.3.4. The access token services do not properly validate that an authenticated principal is equal to that of the supplied clientId parameter allowing a malicious client to use an authorization code that has been issued to a different client as their own. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability." ],
  "statement" : "In OpenShift Logging the openshift-logging/elasticsearch6-rhel8 container bundles the vulnerable version of apache-cxf, but the vulnerable class is not shipped, hence this component is not affected by this vulnerability.",
  "affected_release" : [ {
    "product_name" : "EAP-CD 19 Tech Preview",
    "release_date" : "2020-05-28T00:00:00Z",
    "advisory" : "RHSA-2020:2333",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform_cd:19",
    "package" : "cxf-core",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Fuse 7.7.0",
    "release_date" : "2020-07-28T00:00:00Z",
    "advisory" : "RHSA-2020:3192",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Text-Only RHOAR",
    "release_date" : "2020-05-18T00:00:00Z",
    "advisory" : "RHSA-2020:2067",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  } ],
  "package_state" : [ {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-logging/elasticsearch6-rhel8",
    "cpe" : "cpe:/a:redhat:logging:5"
  }, {
    "product_name" : "Red Hat BPM Suite 6",
    "fix_state" : "Out of support scope",
    "package_name" : "cxf",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat BPM Suite 6",
    "fix_state" : "Out of support scope",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Decision Manager 7",
    "fix_state" : "Not affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6",
    "fix_state" : "Out of support scope",
    "package_name" : "cxf",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6",
    "fix_state" : "Out of support scope",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "fix_state" : "Not affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat OpenShift Application Runtimes",
    "fix_state" : "Affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Not affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Not affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat support for Spring Boot",
    "fix_state" : "Not affected",
    "package_name" : "cxf-core",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "impact" : "moderate"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-12419\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-12419" ],
  "name" : "CVE-2019-12419",
  "csaw" : false
}