Bug 1439980 (CVE-2017-7465)

Summary:	CVE-2017-7465 JBoss: JAXP in EAP 7.0 allows RCE via XSL
Product:	[Other] Security Response	Reporter:	Jason Shepherd <jshepherd>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, asoldano, atangrin, avibelli, bbaranow, belaran-do-not-use, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, dkreling, dosoudil, gsterlin, gzaronik, iweiss, jawilson, jbalunas, jclere, jochrist, jperkins, jshepherd, jwon, krathod, kwills, lgao, mbabacek, msochure, msvehla, myarboro, nwallace, pgier, pjindal, pmackay, pslavice, psotirop, rguimara, rnetuka, rpelisse, rrajasek, rstancel, rsvoboda, security-response-team, smaestri, tkirby, tom.jenkinson, twalsh, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that the JAXP implementation used in EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-15 17:20:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1439976

Description Jason Shepherd 2017-04-07 02:01:06 UTC

It was found that the JAXP implementation used in EAP 7.0 has insecure defaults for XSL processing. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT for parsing.

Comment 1 Jason Shepherd 2017-04-07 02:01:18 UTC

Acknowledgments:

Name: Jason Shepherd (Red Hat)

Comment 5 Jason Shepherd 2017-04-11 22:48:15 UTC

Mitigation:

Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability. Eg:

TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);

Comment 7 errata-xmlrpc 2020-06-15 16:17:00 UTC

This issue has been addressed in the following products:

  EAP-CD 14 Tech Preview

Via RHSA-2020:2563 https://access.redhat.com/errata/RHSA-2020:2563

Comment 8 Product Security DevOps Team 2020-06-15 17:20:22 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-7465