Bug 1922102 (CVE-2021-23926)

Summary:	CVE-2021-23926 xmlbeans: allowed malicious XML input may lead to XML Entity Expansion attack
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, bbaranow, bibryam, bmaxwell, brian.stansberry, cdewolf, chazlett, cmiranda, darran.lofthouse, dhanak, dkreling, dosoudil, drieden, drosa, eleandro, etirelli, fjuma, ganandan, ggaughan, gmalinko, gvarsami, hbraun, ibek, istudens, ivassile, iweiss, janstey, jcoleman, jochrist, jolee, jperkins, jrokos, jschatte, jstastny, jwon, krathod, kverlaen, kwills, ldimaggi, lgao, mnovotny, mosmerov, msochure, msvehla, nwallace, pantinor, pcongius, pdelbell, pesilva, pjindal, pmackay, rguimara, rrajasek, rstancel, rstepani, rsvoboda, rsynek, rwagner, sausingh, sdaley, smaestri, tcunning, tkirby, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	xmlbeans 3.0.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found when parsing XML files using XMLBeans 2.6.0 or below. The underlying parser created by XMLBeans could be susceptible to XML External Entity (XXE) attacks. The highest threat from this vulnerability is to confidentiality and system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-14 22:04:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1922986
Bug Blocks:	1922103

Description Marian Rehak 2021-01-29 09:08:26 UTC

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks.

Reference:

https://issues.apache.org/jira/browse/XMLBEANS-517

Comment 8 Jonathan Christison 2021-02-01 13:43:27 UTC

Red Hat have rated this vulnerability as having an Important impact, although the current CVSS scoring from NVD (9.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) suggests this is a critical issue Red Hat flaw handling policies (https://access.redhat.com/security/updates/classification) requires arbitrary code execution by a remote unauthenticated attacker to be classed as critical, in this case it is not possible for an attacker to run arbitrary code using the XXE flaw alone.

Comment 12 RaTasha Tillery-Smith 2021-02-03 16:49:48 UTC

Mitigation:

Affected users are advised to update to Apache XMLBeans 3.0.0 or above, which fixes this vulnerability.

Comment 15 Jonathan Christison 2021-02-10 15:14:43 UTC

Marking Red Hat JBoss Fuse 6 and Red Hat Fuse 7 as having a moderate impact, this is because although vulnerable versions of xmlbeans are distributed, it is by default not used by fuse application itself, end applications may use xmlbeans via camel-xmlbeans but it is not a first-choice component for XML java mapping and we would advise users of camel-xmlbeans not to parse any XML that is derived from untrusted or uncontrolled sources.

Comment 19 errata-xmlrpc 2021-12-14 21:33:23 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

Comment 20 Product Security DevOps Team 2021-12-14 22:04:55 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-23926