PT-2017-16640 · Apache · Apache Poi

Published 2017-03-24 · Updated 2022-05-13 · CVE-2017-5644

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache POI versions prior to 3.15

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by using a specially crafted OOXML file. This type of attack is known as an XML Entity Expansion (XEE) attack.

Recommendations For versions prior to 3.15, update to version 3.15 or later to resolve the issue. As a temporary workaround, consider restricting the processing of OOXML files from untrusted sources until the update is applied.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2017-5644

GHSA-78VV-QJ73-H9M5

Affected Products

Apache Poi

References · 12

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5644 · Security Note
• http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5644 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5644 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78vv-qj73-h9m5 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-5644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5644 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5644 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/03/20/9 · Note
• https://oracle.com/security-alerts/cpuoct2020.html · Note
• http://securityfocus.com/bid/96983 · Note