Bug 1328427 (CVE-2016-3720) - CVE-2016-3720 jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack
Summary: CVE-2016-3720 jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2016-3720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1332726 1332727
Blocks: 1328429
TreeView+ depends on / blocked
 
Reported: 2016-04-19 11:23 UTC by Adam Mariš
Modified: 2021-02-17 04:02 UTC (History)
5 users (show)

Fixed In Version: jackson-dataformat-xml 2.7.4
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-23 04:10:09 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2016-04-19 11:23:36 UTC 
It was reported that XmlMapper in jackson-dataformat-xml is vulnerable to XXE attack ("Improper Restriction of XML External Entity Reference").
Comment 1 Adam Mariš 2016-04-19 11:23:40 UTC 
Acknowledgments:

Name: Adith Sudhakar
Comment 3 Jason Shepherd 2016-05-03 22:48:06 UTC 
Created jberet tracking bugs for this issue:

Affects: fedora-all [bug 1332726]
Comment 4 Jason Shepherd 2016-05-03 22:48:11 UTC 
Created jackson-dataformat-xml tracking bugs for this issue:

Affects: fedora-all [bug 1332727]
Comment 6 Fedora Update System 2016-05-10 11:46:39 UTC 
jackson-dataformat-xml-2.6.3-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2016-05-15 05:30:42 UTC 
jackson-dataformat-xml-2.5.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2016-05-16 14:53:59 UTC 
jackson-dataformat-xml-2.5.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 9 Adam Mariš 2016-06-22 14:01:35 UTC 
Upstream bug:

https://github.com/FasterXML/jackson-dataformat-xml/issues/190

Fixed in jackson-dataformat-xml 2.7.4
Comment 10 Brett Cave 2016-07-13 14:47:03 UTC 
Who is responsible for updating the CVE / who initially submitted it? A check run against the database still shows 2.7.4 as vulnerable. 

On the upstream issue, the maintainers state that they were not involved with filing the CVE.
Comment 11 Brett Cave 2016-07-13 14:48:34 UTC 
Is the CVE failing due to this issue still reflecting as "NEW". Should the status of this bug stay as New?
Comment 12 Tatu Saloranta 2016-08-16 17:59:09 UTC 
Is there any chance to get status updated: Fixed (as per comments above) in 2.7.4, as well as 2.8.0 (and all later versions). As the author of Jackson I can provide more details if and as needed, but I am not sure what can be done at this point.
Comment 13 Jason Shepherd 2016-09-23 04:10:09 UTC 
This flaw had the 'fixedin' field set to 2.7.4 since 22nd June, 2016. It seems they field is not being read by NVD. You might need to contact them directly.
Note You need to log in before you can comment on or make changes to this bug.