VDB
RHSA-2013:1006
RHSA-2013:1006
PUBLISHED
CVSS 7.800000190734863 HIGH
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Risk Scores
CVSS 2.0
7.800000190734863
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | JBoss Enterprise BRMS Platform 5.3 |
Timeline
- Jul 1, 2013 CVE Published
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- Jun 27, 2026 CVE Updated
- Jun 27, 2026 Security Advisory
- Jun 27, 2026 Security Advisory
References
- http://cxf.apache.org/cve-2012-5575.html advisory
- https://access.redhat.com/security/cve/CVE-2012-5885 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5887 advisory
- https://access.redhat.com/errata/RHSA-2013:1006 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=873317 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1006.json advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5575 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5575 advisory
- http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/ advisory
- https://access.redhat.com/security/cve/CVE-2012-5783 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5783 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5885 advisory
- https://www.cve.org/CVERecord?id=CVE-2012-5886 advisory
- https://access.redhat.com/security/cve/CVE-2012-5887 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-5887 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=5.3.1 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=873664 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=880443 issue
- https://access.redhat.com/security/cve/CVE-2012-5575 advisory
…and 4 more