PT-2018-11247 · Eclipse · Eclipse Vert.X

Yanshuchong · Publicado 2018-10-10 · Atualizado 2020-12-16 · CVE-2018-12544

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 3.5.Beta1 through 3.5.3

Description The OpenAPI XML type validator in Eclipse Vert.x creates XML parsers without adequate protection against XML attacks when a developer uses it to validate a provided schema.

Recommendations For versions 3.5.Beta1 through 3.5.3, consider disabling the OpenAPI XML type validator until a patch is available to prevent potential XML attacks. Restrict the use of XML parsers to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-12544

GHSA-QH3M-QW6V-QVHG

Produtos afetados

Eclipse Vert.X

Referências · 11

• https://github.com/vert-x3/vertx-web/issues/1021 · Correção
• https://github.com/vert-x3/vertx-web/commit/ac8692c618d6180a9bc012a2ac8dbec821b1a97 · Nota
• https://osv.dev/vulnerability/CVE-2018-12544 · Aviso do Fabricante
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568 · Aviso do Fabricante
• https://t.me/cvenotify/7146 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qh3m-qw6v-qvhg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12544 · Nota de Segurança
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2018:2946 · Aviso do Fabricante
• https://github.com/advisories/GHSA-qh3m-qw6v-qvhg · Nota