Skip to content
Fencer Intel
high 8.1

CVE-2018-8039 json

Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

published 2018-07-02 8 y ago modified 2026-06-17 4 mo ago also GHSA-jc7r-v6fg-2gpf , EUVD-2018-0630

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.2%
EPSS 8.2% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

Patch / fix

  • maven org.apache.cxf:cxf-rt-transports-http 3.1.16, 3.2.5
  • maven org.apache.cxf:apache-cxf 3.1.16, 3.2.5
  • apache cxf 3.1.16, 3.2.5
  • eap7-guava jboss enterprise application platform 7.1 25.0.0-1.redhat_1.1.ep7.el7
  • eap7-jberet jboss enterprise application platform 7.1 1.2.6-2.Final_redhat_1.1.ep7.el7
  • eap7-wildfly jboss enterprise application platform 7.1 7.1.4-1.GA_redhat_1.1.ep7.el7
  • eap7-narayana jboss enterprise application platform 7.1 5.5.32-1.Final_redhat_1.1.ep7.el7
  • eap7-resteasy jboss enterprise application platform 7.1 3.0.26-1.Final_redhat_1.1.ep7.el7
  • eap7-undertow jboss enterprise application platform 7.1 1.4.18-7.SP8_redhat_1.1.ep7.el7
  • eap7-hibernate jboss enterprise application platform 7.1 5.1.15-1.Final_redhat_1.1.ep7.el7
  • eap7-ironjacamar jboss enterprise application platform 7.1 1.4.10-1.Final_redhat_1.1.ep7.el7

red hat advisories RHSA-2018:2424RHSA-2018:2423RHSA-2018:2643RHSA-2018:2276

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-8039 updated cvss 6.5

apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

  • Red Hat OpenShift Application Runtimes cxf-core
    affected: no fix available
  • Red Hat Fuse 7.2
    fixed: vendor fix RHSA-2018:3768
  • Red Hat JBoss A-MQ 6.3
    fixed: vendor fix RHSA-2018:3817
  • Red Hat JBoss EAP 7.1
    fixed: vendor fix RHSA-2018:2277
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-guava 25.0.0-1.redhat_1.1.ep7.el6, eap7-wss4j 2.1.12-1.redhat_1.1.ep7.el6, eap7-wildfly 7.1.3-4.GA_redhat_3.1.ep7.el6, eap7-wildfly 7.1.4-1.GA_redhat_1.1.ep7.el6, eap7-apache-cxf 3.1.16-1.redhat_1.1.ep7.el6, eap7-jberet 1.2.6-2.Final_redhat_1.1.ep7.el6, +115 more
    fixed: vendor fix RHSA-2018:2423
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-guava 25.0.0-1.redhat_1.1.ep7.el7, eap7-wss4j 2.1.12-1.redhat_1.1.ep7.el7, eap7-wildfly 7.1.3-4.GA_redhat_3.1.ep7.el7, eap7-wildfly 7.1.4-1.GA_redhat_1.1.ep7.el7, eap7-apache-cxf 3.1.16-1.redhat_1.1.ep7.el7, eap7-jberet 1.2.6-2.Final_redhat_1.1.ep7.el7, +115 more
    fixed: vendor fix RHSA-2018:2276
  • Red Hat JBoss Fuse 6.3
    fixed: vendor fix RHSA-2018:3817
  • Red Hat Single Sign-On 7.2
    fixed: vendor fix RHSA-2018:2279
show 3 more
  • Red Hat Single Sign-On 7.2.4 zip
    fixed: vendor fix RHSA-2018:2428
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance 4.2-20180828.0.el7 Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance 4.2-20180828.0.el7
    fixed: vendor fix RHSA-2018:2643
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat BPM Suite 6 cxf-core Red Hat JBoss BRMS 6 cxf Red Hat JBoss Data Virtualization 6 cxf-core Red Hat JBoss Enterprise Application Platform 6 cxf-core Red Hat Single Sign-On 7 cxf-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.21% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.cxf:cxf-rt-transports-http
>=3.2.0, <3.2.5
<3.1.16
3.2.5
3.1.16
maven org.apache.cxf:apache-cxf
>=3.2.0, <3.2.5
<3.1.16
3.2.5
3.1.16

Affected products

  • Apache Software Foundation Apache CXF

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.