PT-2017-9774 · Apache · Apache Abdera Parser+1

0Ang3El + 1 · Published 2017-08-10 · Updated 2022-05-13 · CVE-2016-8739

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.12 Apache CXF versions 3.1.x prior to 3.1.9

Description The issue concerns the JAX-RS module in Apache CXF, which provides Atom JAX-RS MessageBodyReaders that utilize the Apache Abdera Parser. This parser expands XML entities by default, posing a significant XML External Entity (XXE) risk.

Recommendations For Apache CXF versions prior to 3.0.12, update to version 3.0.12 or later. For Apache CXF versions 3.1.x prior to 3.1.9, update to version 3.1.9 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2016-8739

GHSA-X7XF-253V-X3W8

Affected Products

Apache Abdera Parser

Apache Cxf

References · 22

• http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:0868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8739 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x7xf-253v-x3w8 · Vendor Advisory
• https://github.com/apache/cxf · Note
• https://github.com/apache/cxf/commit/9deb2d17 · Note
• https://github.com/apache/cxf/commit/8e4970d9 · Note
• https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E · Note
• https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E · Note