Skip to content

[GHSA-93g8-qqv3-mrx8] Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory - #9597

Open
wojciechtrzaski wants to merge 1 commit into
wojciechtrzaski/advisory-improvement-9597from
wojciechtrzaski-GHSA-93g8-qqv3-mrx8
Open

wojciechtrzaski wants to merge 1 commit into
wojciechtrzaski/advisory-improvement-9597from
wojciechtrzaski-GHSA-93g8-qqv3-mrx8

Conversation

@wojciechtrzaski

Copy link
Copy Markdown

Updates

  • Affected products
  • Description
  • References
  • Summary

Comments
Please check these links:

https://www.cve.org/CVERecord?id=CVE-2026-50632
apache/cxf@31eb1f90d4

Copilot AI balanced review requested due to automatic review settings September 17, 2026 12:18
@github-actions
github-actions Bot changed the base branch from main to wojciechtrzaski/advisory-improvement-9597 September 17, 2026 12:19

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The summary mischaracterizes the vulnerability, and the affected ranges contain invalid combined versions and incorrect boundaries.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the Apache CXF JNDI injection advisory’s affected versions, description, summary, and references.

Changes:

  • Adds Apache CXF 3.6.12 remediation information.
  • Revises advisory text and affected ranges.
  • Replaces several references with upstream sources.
File summaries
File Description
GHSA-93g8-qqv3-mrx8.json Updates advisory metadata, version ranges, and references.
Review details

Suppressed comments (2)

advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json:37

  • This metadata broadens the first entry to every version below 4.2.2 even though its range starts at 4.2.0. Include the lower bound so downstream range displays do not report older releases as part of this branch.
        "last_known_affected_version_range": "< 4.2.2"

advisories/github-reviewed/2026/06/GHSA-93g8-qqv3-mrx8/GHSA-93g8-qqv3-mrx8.json:57

  • This comma-separated value is not a valid single fixed version, and keeping introduced: 0 would incorrectly mark 3.6.12 through 3.x as affected. Model the CNA's disjoint < 3.6.12 and >= 4.0.0, < 4.1.7 intervals as separate affected entries, as done for the same three-branch layout in GHSA-ghvc-7hp8-2g2v.json:17-74.
              "fixed": "3.6.12, 4.1.7"
            }
          ]
        }
      ],
  • Files reviewed: 1/1 changed files
  • Comments generated: 3
  • Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

},
{
"fixed": "4.2.2"
"fixed": "3.6.12, 4.2.2"
],
"summary": "Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory",
"details": "A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.",
"summary": "Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory - false positive",
"summary": "Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory",
"details": "A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.",
"summary": "Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory - false positive",
"details": "Change the < 4.1.7 range to >= 4.0.0, < 4.1.7 and add a new < 3.6.12 range with patched version 3.6.12.",
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants