PT-2023-18612 · Apache+1 · Apache Jena+1

L3Yx · Published 2023-04-25 · Updated 2024-01-21 · CVE-2023-22665

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jena versions 3.7.0 through 4.8.0

Description The issue is related to insufficient checking of user queries and restrictions of called script functions in Apache Jena, allowing a remote user to execute arbitrary javascript via a SPARQL query.

Recommendations For Apache Jena versions 3.7.0 through 4.8.0, consider disabling custom script invocation until a patch is available to prevent the execution of arbitrary javascript. Restrict access to SPARQL query endpoints to minimize the risk of exploitation. Avoid using custom scripts in Apache Jena until the issue is resolved.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2023-22665

GHSA-J927-W6G7-7C7W

GHSA-XGH5-GWQ5-RPX8

Affected Products

Apache Jena

Debian

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2023-22665 · Security Note
• https://ubuntu.com/security/CVE-2023-22665 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j927-w6g7-7c7w · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22665 · Vendor Advisory
• https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32200 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-22665 · Security Note
• https://osv.dev/vulnerability/GHSA-xgh5-gwq5-rpx8 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22665 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22665 · Vendor Advisory
• https://github.com/apache/jena · Note
• http://openwall.com/lists/oss-security/2023/07/11/11 · Note
• https://t.me/cvenotify/68154 · Telegram Post
• https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z · Note