Bug 1105242 (CVE-2014-3481)
| Summary: | CVE-2014-3481 JBoss AS JAX-RS: Information disclosure via XML eXternal Entity (XXE) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Arun Babu Neelicattu <aneelica> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbaranow, bdawidow, ccoleman, cdewolf, chazlett, dandread, darran.lofthouse, dmcphers, epp-bugs, grocha, jason.greene, jawilson, jcoleman, jdg-bugs, jialiu, jkudrnac, jokerman, jpallich, jrusnack, kanovotn, kconner, kejohnso, lgao, lmeyer, mgoldman, mmccomas, mmcgrath, mmiura, mweiler, myarboro, pgier, pslavice, rhq-maint, rsvoboda, sdouglas, security-response-team, soa-p-jira, spinder, theute, ttarrant, vtunka, weli |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | WildFly 9.0.0.Beta1, jboss-as-jaxrs-7.3.4.Final-redhat-1 | Doc Type: | Bug Fix |
| Doc Text: |
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity (XXE) attacks on RESTEasy applications accepting XML input.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 02:33:19 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1105142, 1105250, 1124642, 1124643, 1124644, 1124645, 1124646, 1124647, 1124648, 1124649, 1124650, 1124651, 1160697, 1166434 | ||
| Bug Blocks: | 1105426, 1108493, 1124639, 1139455, 1182400, 1182419, 1200191 | ||
|
Description
Arun Babu Neelicattu
2014-06-05 16:29:22 UTC
Acknowledgements: This issue was discovered by the Red Hat JBoss Enterprise Application Platform QE team. This issue has been addressed in following products: Red Hat JBoss Enterprise Application Platform 6.2.4 Via RHSA-2014:0797 https://rhn.redhat.com/errata/RHSA-2014-0797.html This issue has been addressed in following products: JBEAP 6.2 for RHEL 5 Via RHSA-2014:0798 https://rhn.redhat.com/errata/RHSA-2014-0798.html This issue has been addressed in following products: JBEAP 6.2 for RHEL 6 Via RHSA-2014:0799 https://rhn.redhat.com/errata/RHSA-2014-0799.html Created wildfly tracking bugs for this issue: Affects: fedora-all [bug 1124642] Upstream Issue: https://issues.jboss.org/browse/WFLY-3458 This issue has been addressed in following products: JBoss Data Grid 6.3.0 Via RHSA-2014:0895 https://rhn.redhat.com/errata/RHSA-2014-0895.html This issue has been addressed in the following products: JBoss Operations Network 3.3.0 Via RHSA-2014:1904 https://rhn.redhat.com/errata/RHSA-2014-1904.html This issue has been addressed in the following products: JBoss Data Virtualization 6.1.0 Via RHSA-2015:0675 https://rhn.redhat.com/errata/RHSA-2015-0675.html This issue has been addressed in the following products: Red Hat JBoss Fuse Service Works 6.0.0 Via RHSA-2015:0720 https://rhn.redhat.com/errata/RHSA-2015-0720.html This issue has been addressed in the following products: Red Hat JBoss Data Virtualization 6.0.0 Via RHSA-2015:0765 https://rhn.redhat.com/errata/RHSA-2015-0765.html This issue has been addressed in the following products: JBoss Portal 6.2.0 Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html |