PT-2021-4202 · Apache · Apache Jena

Andy Seaborne · Published 2021-09-16 · Updated 2021-10-06 · CVE-2021-39239

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Jena versions up to 4.1.0

Description A vulnerability in XML processing may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server. The issue is related to incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to disclose protected information.

Recommendations For versions up to 4.1.0, update to a version later than 4.1.0 to resolve the issue. As a temporary workaround, consider restricting XML processing to minimize the risk of exploitation. Avoid using XML External Entities (XXE) in XML processing until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-04799

CVE-2021-39239

GHSA-7RP6-W7MG-H8RW

Affected Products

Apache Jena

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2021-39239 · Security Note
• https://ubuntu.com/security/CVE-2021-39239 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-39239 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39239 · Security Note
• https://osv.dev/vulnerability/GHSA-7rp6-w7mg-h8rw · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04799 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39239 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39239 · Vendor Advisory
• https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45@%3Cdev.jena.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d%40%3Cdev.jena.apache.org%3E · Note
• https://t.me/cybersecuritytechnologies/4454 · Telegram Post
• https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45%40%3Cdev.jena.apache.org%3E · Note