AI analysis
Apache Neethi, a Java library that parses and processes WS-Policy documents, is vulnerable to an algorithmic-complexity denial of service in its policy-intersection logic. An attacker who can supply two specially crafted WS-Policy documents that the application intersects can force Neethi to perform exponential amounts of work, pinning the CPU for an extended period and degrading or exhausting service availability. Practical risk is highest for applications that accept policy documents from untrusted sources, such as SOAP/WS-* web service endpoints that process client-supplied policies. All users of Neethi prior to the fixed release are affected; the issue is resolved in version 3.2.4. There is no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported.
What to do: Upgrade Apache Neethi to 3.2.4, and check your dependency tree for transitive 'org.apache.neethi' artifacts that may still resolve an older version. If upgrading is not immediately possible, avoid intersecting WS-Policy documents from untrusted sources and enforce strict size and complexity limits on any policy input your services accept. Watch for sustained CPU spikes on hosts running WS-Policy-processing services as an indicator of attempted abuse.
Affected
| Apache Neethi | versions prior to 3.2.4 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.