CVE-2018-8038: Improper Input Validation

July 5, 2018 (updated January 16, 2020)

Versions of Apache CXF Fediz do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

References

cxf.apache.org/security-advisories.data/CVE-2018-8038.txt.asc
www.securitytracker.com/id/1041220
nvd.nist.gov/vuln/detail/CVE-2018-8038

Detect and mitigate CVE-2018-8038 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →