PT-2018-11247 · Eclipse · Eclipse Vert.X

Yanshuchong · Published 2018-10-10 · Updated 2020-12-16 · CVE-2018-12544

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 3.5.Beta1 through 3.5.3

Description The OpenAPI XML type validator in Eclipse Vert.x creates XML parsers without adequate protection against XML attacks when a developer uses it to validate a provided schema.

Recommendations For versions 3.5.Beta1 through 3.5.3, consider disabling the OpenAPI XML type validator until a patch is available to prevent potential XML attacks. Restrict the use of XML parsers to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-12544

GHSA-QH3M-QW6V-QVHG

Affected Products

Eclipse Vert.X

References · 11

• https://github.com/vert-x3/vertx-web/issues/1021 · Patch
• https://osv.dev/vulnerability/CVE-2018-12544 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh3m-qw6v-qvhg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12544 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2946 · Vendor Advisory
• https://github.com/vert-x3/vertx-web/commit/ac8692c618d6180a9bc012a2ac8dbec821b1a97 · Note
• https://t.me/cvenotify/7146 · Telegram Post
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E · Note
• https://github.com/advisories/GHSA-qh3m-qw6v-qvhg · Note