Is CVE-2018-8039 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 10%.

What products does CVE-2018-8039 affect?

Tracked products affected include JBoss. Check the version you run to see whether it is affected.

How do I fix CVE-2018-8039?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2018-8039

Q: What is CVE-2018-8039?

CVE-2018-8039 is a high-severity software vulnerability (CWE-755) with a CVSS score of 8.1. It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to

HIGH severity · CVSS 8.1 · CWE-755

8.1CVSS HIGH

Summary

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

Impact & exploitability

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)10%

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

JBoss

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2018-8039

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information