Bug 1075328 (CVE-2014-0054)

Summary:	CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bleanhar, ccoleman, chazlett, dmcphers, jialiu, lmeyer, mjc, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	spring mvc 3.2.8, spring mvc 4.0.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-20 10:44:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1079030
Bug Blocks:	1075354

Description Murray McAllister 2014-03-12 04:16:26 UTC

The fixes for the CVE-2013-7315 (bug 1061509) and CVE-2013-6429 (bug 1053290) XML External Entity (XXE) issues were found to be incomplete. From the original advisory:

"Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default."

This issue affects versions 3.0.0 to 3.2.8, and versions 4.0.0 to 4.0.1.

External References:

http://www.gopivotal.com/security/cve-2014-0054

Comment 3 Kurt Seifried 2014-03-20 20:17:24 UTC

Statement:

The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.

Comment 4 Chess Hazlett 2014-04-15 02:37:32 UTC

This issue has been addressed in following products:

  Red Hat JBoss AM-Q 6.1.0

Via RHSA-2014:0401 https://rhn.redhat.com/errata/RHSA-2014-0401.html

Comment 5 Chess Hazlett 2014-04-15 02:40:33 UTC

This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.1.0

Via RHSA-2014:0400 https://rhn.redhat.com/errata/RHSA-2014-0400.html

Comment 6 Kurt Seifried 2014-09-05 19:55:29 UTC

This issue is being deferred for OpenShift Enterprise 2, only authenticated users have access to ActiveMQ (and thus the ability to exploit this Spring issue). A later update may address this issue.