CVE-2018-8039: Improper Handling of Exceptional Conditions
(updated )
It is possible to configure Apache CXF to use the com.sun.net.ssl
implementation via System.setProperty
. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier
work with the old com.sun.net.ssl.HostnameVerifier
interface. However, the default HostnameVerifier
implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl
stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
References
Detect and mitigate CVE-2018-8039 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →