CVE-2019-12423

CVE-2019-12423 describes a critical information disclosure vulnerability in Apache CXF, affecting Apache and Oracle products. When configured to use a JWK keystore file, the service could inadvertently expose all private and secret key credentials if the user included them in the signature keystore. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-exploitable flaw with low attack complexity and high confidentiality impact, as it allows unauthorized access to sensitive cryptographic keys. While the EPSS score is low and there's no evidence of active exploitation, public exploit code, or significant community discussion, the potential for compromise of cryptographic material makes remediation crucial. Patches in CXF 3.3.5 and 3.2.12 address this by requiring an alias and omitting private/secret key information by default.