| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.cxf:apache-cxf | ≥ 3.4.0, < 3.4.4< 3.3.11 | 3.4.43.3.11 |
| org.apache.cxf:cxf | ≥ 3.4.0, < 3.4.4< 3.3.11 | 3.4.43.3.11 |
| cxf | ≥ 3.4.0, < 3.4.4< 3.3.11 | 3.4.43.3.11 |
| tomee | = 8.0.6 | |
| business intelligence | = 12.2.1.3.0= 12.2.1.4.0= 5.5.0.0.0= 5.9.0.0.0 | |
| communications element manager | = 8.2.2 |
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free