PT-2021-7289 · Apache+1 · Apache Xmlbeans+1

Published 2021-01-14 · Updated 2022-12-06 · CVE-2021-23926

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache XMLBeans versions up to and including 2.6.0

Description The issue is related to errors in processing XML entities in the Java-to-XML Apache XMLBeans tool. This can allow a remote attacker to cause a denial of service or disclose protected information. The XML parsers used by XMLBeans did not set the necessary properties to protect against malicious XML input, making them vulnerable to XML Entity Expansion attacks.

Recommendations For Apache XMLBeans versions up to and including 2.6.0, update to a version later than 2.6.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

BDU:2022-05231

CVE-2021-23926

DLA-2693-1

GHSA-MW3R-PFMG-XP92

OESA-2021-1077

OPENSUSE-SU-2022_3875-1

OPENSUSE-SU-2024:12455-1

SUSE-SU-2022:3875-1

SUSE-SU-2022:3876-1

SUSE-SU-2022_3875-1

SUSE-SU-2022_3876-1

Affected Products

Apache Xmlbeans

Suse

References · 31

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23926 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3875-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23926 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23926 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/OESA-2021-1077 · Vendor Advisory
• https://poi.apache.org · Vendor Advisory
• https://issues.apache.org/jira/browse/XMLBEANS-517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw3r-pfmg-xp92 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3876-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://osv.dev/vulnerability/DLA-2693-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23926 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-23926 · Vendor Advisory