PT-2018-5970 · Apache · Apache Uima+3

Joern Kottmann · Published 2018-04-26 · Updated 2022-05-14 · CVE-2017-15691

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache uimaj versions prior to 2.10.2 Apache uimaj 3.0.0-xxx versions prior to 3.0.0-beta Apache uima-as versions prior to 2.10.2 Apache uimaFIT versions prior to 2.4.0 Apache uimaDUCC versions prior to 2.2.2

Description: The issue relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA, as part of its configuration and operation, may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.

Recommendations: For Apache uimaj versions prior to 2.10.2, update to version 2.10.2 or later. For Apache uimaj 3.0.0-xxx versions prior to 3.0.0-beta, update to version 3.0.0-beta or later. For Apache uima-as versions prior to 2.10.2, update to version 2.10.2 or later. For Apache uimaFIT versions prior to 2.4.0, update to version 2.4.0 or later. For Apache uimaDUCC versions prior to 2.2.2, update to version 2.2.2 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-15691

GHSA-WP2F-HRG2-3R5M

Affected Products

Apache Uima-As

Apache Uima Ducc

Apache Uimafit

Apache Uima

References · 12

• https://access.redhat.com/errata/RHSA-2019:1545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15691 · Security Note
• https://uima.apache.org/security_report#CVE-2017-15691 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wp2f-hrg2-3r5m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15691 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15691 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15691 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15691 · Security Note
• https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E · Note
• https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79@%3Ccommits.uima.apache.org%3E · Note