PT-2014-4332 · Restlet · Restlet Framework

Alvaro Munoz · Publicado 2014-10-06 · Atualizado 2018-10-17 · CVE-2014-1868

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Restlet Framework versions 2.1.x through 2.1.7 Restlet Framework versions 2.x.x through 2.2 RC1

Description The issue allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack when using XMLRepresentation or XML serializers.

Recommendations For versions 2.1.x through 2.1.7, update to version 2.1.7 or later. For versions 2.x.x through 2.2 RC1, update to version 2.2 RC1 or later.

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2014-1868

GHSA-73CQ-FHP3-8RPW

Produtos afetados

Restlet Framework

Referências · 11

• https://github.com/restlet/restlet-framework-java · Nota
• https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1868 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1868 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91181 · Nota
• https://cve.org/CVERecord?id=CVE-2014-1868 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-1868 · Aviso do Fabricante
• https://github.com/advisories/GHSA-73cq-fhp3-8rpw · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1868 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-73cq-fhp3-8rpw · Aviso do Fabricante
• http://secunia.com/advisories/56940 · Nota