PT-2017-9774 · Apache · Apache Abdera Parser+1

0Ang3El + 1 · Publicado 2017-08-10 · Atualizado 2022-05-13 · CVE-2016-8739

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.12 Apache CXF versions 3.1.x prior to 3.1.9

Description The issue concerns the JAX-RS module in Apache CXF, which provides Atom JAX-RS MessageBodyReaders that utilize the Apache Abdera Parser. This parser expands XML entities by default, posing a significant XML External Entity (XXE) risk.

Recommendations For Apache CXF versions prior to 3.0.12, update to version 3.0.12 or later. For Apache CXF versions 3.1.x prior to 3.1.9, update to version 3.1.9 or later.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2016-8739

GHSA-X7XF-253V-X3W8

Produtos afetados

Apache Abdera Parser

Apache Cxf

Referências · 22

• https://github.com/apache/cxf · Nota
• https://github.com/apache/cxf/commit/9deb2d17 · Nota
• https://github.com/apache/cxf/commit/8e4970d9 · Nota
• http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc · Aviso do Fabricante
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2017:0868 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8739 · Nota de Segurança
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E · Nota