Bug 1970584 (CVE-2017-12621)

Summary:	CVE-2017-12621 commons-jelly: Apache Commons Jelly connects to URL with custom doctype definitions
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, aos-bugs, bmontgom, eparis, jburrell, jokerman, nstielau, pbhattac, sponnaga, vbobade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	commons-jelly 1.0.1	Doc Type:	If docs needed, set a value
Doc Text:	An XML External Entity (XXE) Injection vulnerability was found in Commons Jelly library. If a custom `doctype` entity is declared with a `SYSTEM` entity with a URL and that entity is used in the body of the Jelly file, the parser will attempt to connect to provided URL.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-14 15:04:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1970585

Description Pedro Sampaio 2021-06-10 18:05:18 UTC

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

References:

http://www.securityfocus.com/bid/101052
http://www.securitytracker.com/id/1039444
https://issues.apache.org/jira/browse/JELLY-293
https://lists.apache.org/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73@%3Cdev.commons.apache.org%3E

Comment 1 Przemyslaw Roguski 2021-06-14 11:33:34 UTC

In Jenkins LTS there is used Jenkins version of commons-jelly-1.1.

Comment 2 Product Security DevOps Team 2021-06-14 15:04:18 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-12621