Bug 1451960 (CVE-2017-7503)
| Summary: | CVE-2017-7503 EAP: XXE issue in TransformerFactory | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jason Shepherd <jshepherd> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aboyko, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, dbragalo, dimitris, dkreling, dosoudil, iweiss, jawilson, jochrist, jperkins, jshepherd, jwon, krathod, kwills, lgao, msochure, msvehla, myarboro, nwallace, pgier, pjindal, pmackay, ppalaga, pslavice, psotirop, puntogil, rguimara, rmartinc, rnetuka, rstancel, rsvoboda, smaestri, tom.jenkinson, twalsh, vtunka |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-06-15 17:20:26 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1451961 | ||
| Bug Blocks: | 1439976 | ||
|
Description
Jason Shepherd
2017-05-18 02:23:05 UTC
Created wildfly tracking bugs for this issue: Affects: fedora-all [bug 1451961] Acknowledgments: Name: Jason Shepherd (Red Hat Product Security), Katerina Novotna (Red Hat Quality Engineering) It will be difficult to fix this issue in Xerces. The patch which contains the fix in OpenJDK contains many other related changes. It appears to be fixed in revision 292:7b89fed7212b of the jaxp repo, http://hg.openjdk.java.net/jdk8/jdk8/jaxp/ An alternative might be to remove Xerces from EAP. However it will be difficult to remove and still maintain support for IBM JDK, see https://issues.jboss.org/browse/WFCORE-2805?focusedCommentId=13447139&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13447139 Mitigation: This issue affects processing of XML content from an untrusted source using a javax.xml.transform.TransformerFactory. The only safe way to process untrusted XML content with a TransformerFactory is to use the StAX API. StAX is a safe implementation on EAP 7.0.x because the XML content is not read in it's entirety in order to parse it. As a developer using StAX, you decide which XML stream events you want to react to, so XXE control constructs won't be processed automatically by the parser. This issue has been addressed in the following products: EAP-CD 14 Tech Preview Via RHSA-2020:2563 https://access.redhat.com/errata/RHSA-2020:2563 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2017-7503 |