Bug 1973413 (CVE-2021-33813)

Summary:	CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, akoufoud, alazarot, anstephe, aos-bugs, asoldano, atangrin, ataylor, bbaranow, bibryam, bkramer, bmaxwell, bmontgom, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dbhole, dkreling, dosoudil, drieden, eleandro, eparis, etirelli, fjuma, ggaughan, gmalinko, gvarsami, hbraun, hhorak, ibek, iweiss, janstey, java-maint-sig, java-sig-commits, jburrell, jcoleman, jochrist, jolee, jorton, jpallich, jperkins, jrokos, jross, jschatte, jstastny, jwon, krathod, krzysztof.daniel, kverlaen, kwills, ldimaggi, lgao, loleary, mizdebsk, mnovotny, msochure, msvehla, nstielau, nwallace, pantinor, pjindal, pmackay, puntogil, rguimara, rrajasek, rstancel, rsvoboda, rwagner, sd-operator-metering, smaestri, sponnaga, tcunning, tflannag, theute, tkirby, tom.jenkinson, tzimanyi, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-29 16:01:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1973414, 1973415, 1973416, 1973557, 1973558, 1975520, 1975521, 1975522, 1975523, 1975877, 1975878, 1976298, 1976299
Bug Blocks:	1973417

Description Guilherme de Almeida Suckevicz 2021-06-17 19:02:36 UTC

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

References:
https://alephsecurity.com/vulns/aleph-2021003
http://jdom.org/news/index.html

Upstream patch:
https://github.com/hunterhacker/jdom/pull/188

Comment 1 Guilherme de Almeida Suckevicz 2021-06-17 19:03:19 UTC

Created javapackages-bootstrap tracking bugs for this issue:

Affects: fedora-all [bug 1973415]


Created javapackages-tools tracking bugs for this issue:

Affects: fedora-all [bug 1973416]


Created jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973414]

Comment 2 Tomas Hoger 2021-06-18 07:14:01 UTC

Created javapackages-bootstrap:202001/jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973557]


Created javapackages-tools:202001/jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973558]

Comment 4 Todd Cullum 2021-06-23 20:19:22 UTC

FYI - In jdom (not jdom2), it seems that this vulnerable functionality is in the setFeaturesAndProperties() private method, but in jdom2, it was moved into configureParser() and setFeaturesAndProperties() was removed. E.G. older code from jdom-1.1.3:

```
private void setFeaturesAndProperties(XMLReader parser, boolean coreFeatures) throws JDOMException {
    Iterator iter = this.features.keySet().iterator();
    while (iter.hasNext()) {
      String name = iter.next();
      Boolean value = (Boolean)this.features.get(name);
      internalSetFeature(parser, name, value.booleanValue(), name);
    } 
    iter = this.properties.keySet().iterator();
    while (iter.hasNext()) {
      String name = iter.next();
      internalSetProperty(parser, name, this.properties.get(name), name);
    } 
    if (coreFeatures) {
      try {
        internalSetFeature(parser, "http://xml.org/sax/features/validation", this.validate, "Validation");
      } catch (JDOMException e) {
        if (this.validate)
          throw e; 
      } 
      internalSetFeature(parser, "http://xml.org/sax/features/namespaces", true, "Namespaces");
      internalSetFeature(parser, "http://xml.org/sax/features/namespace-prefixes", true, "Namespace prefixes");
    } 
    try {
      if (parser.getFeature("http://xml.org/sax/features/external-general-entities") != this.expand)
        parser.setFeature("http://xml.org/sax/features/external-general-entities", this.expand); 
    } catch (SAXNotRecognizedException sAXNotRecognizedException) {
    
    } catch (SAXNotSupportedException sAXNotSupportedException) {}
  }
  
  private void internalSetFeature(XMLReader parser, String feature, boolean value, String displayName) throws JDOMException {
    try {
      parser.setFeature(feature, value);
    } catch (SAXNotSupportedException e) {
      throw new JDOMException(displayName + " feature not supported for SAX driver " + parser
          .getClass().getName());
    } catch (SAXNotRecognizedException e) {
      throw new JDOMException(displayName + " feature not recognized for SAX driver " + parser
          .getClass().getName());
    } 
  }
```

Comment 19 errata-xmlrpc 2022-03-23 08:22:51 UTC

This issue has been addressed in the following products:

  RHINT Camel-K 1.6.4

Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029

Comment 20 errata-xmlrpc 2022-03-29 13:00:32 UTC

This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108

Comment 21 errata-xmlrpc 2022-03-29 13:16:47 UTC

This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110

Comment 22 Product Security DevOps Team 2022-03-29 16:01:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-33813

Comment 23 errata-xmlrpc 2022-07-07 14:20:30 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532