PT-2017-16640 · Apache · Apache Poi

Publicado 2017-03-24 · Atualizado 2022-05-13 · CVE-2017-5644

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache POI versions prior to 3.15

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by using a specially crafted OOXML file. This type of attack is known as an XML Entity Expansion (XEE) attack.

Recommendations For versions prior to 3.15, update to version 3.15 or later to resolve the issue. As a temporary workaround, consider restricting the processing of OOXML files from untrusted sources until the update is applied.

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2017-5644

GHSA-78VV-QJ73-H9M5

Produtos afetados

Apache Poi

Referências · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5644 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5644 · Nota de Segurança
• http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-5644 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5644 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-78vv-qj73-h9m5 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/03/20/9 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-5644 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://ubuntu.com/security/CVE-2017-5644 · Aviso do Fabricante
• http://securityfocus.com/bid/96983 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5644 · Aviso do Fabricante