Bug 1151364 (CVE-2014-6517)
| Summary: | CVE-2014-6517 OpenJDK: StAX parser parameter entity XXE (JAXP, 8039533) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dbhole, jshepherd, jvanek, omajid, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-09-03 01:24:51 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1148726, 1167418 | ||
|
Description
Tomas Hoger
2014-10-10 08:47:47 UTC
Public now via Oracle Critical Patch Update - October 2014. Fixed in Oracle Java SE 6u85, 7u71, and 8u25. External References: http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2014:1633 https://rhn.redhat.com/errata/RHSA-2014-1633.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2014:1620 https://rhn.redhat.com/errata/RHSA-2014-1620.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 Via RHSA-2014:1634 https://rhn.redhat.com/errata/RHSA-2014-1634.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2014:1636 https://rhn.redhat.com/errata/RHSA-2014-1636.html IssueDescription: It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents. This issue was fixed in IcedTea6 1.13.5 and IcedTea7 2.5.3: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029884.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029889.html Upstream OpenJDK commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/6ceccd58477d This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Via RHSA-2014:1658 https://rhn.redhat.com/errata/RHSA-2014-1658.html This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Via RHSA-2014:1657 https://rhn.redhat.com/errata/RHSA-2014-1657.html |