PT-2018-11570 · Apache · Apache Juddi

Alex Oree · Published 2018-02-09 · Updated 2018-10-19 · CVE-2018-1307

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache jUDDI versions 3.2 through 3.3.4

Description The issue concerns a lack of protection against entity expansion and DTD type of attacks when using the WADL2Java or WSDL2Java classes to parse local or remote XML documents. These classes mediate the data structures into UDDI data structures.

Recommendations For Apache jUDDI versions 3.2 through 3.3.4, update to version 3.3.5 to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-1307

GHSA-P99P-726H-C8V5

Affected Products

Apache Juddi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1307 · Security Note
• https://osv.dev/vulnerability/GHSA-p99p-726h-c8v5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1307 · Vendor Advisory
• https://issues.apache.org/jira/browse/JUDDI-987 · Vendor Advisory
• http://juddi.apache.org/security.html · Vendor Advisory
• https://github.com/advisories/GHSA-p99p-726h-c8v5 · Note