Bug 2047200 (CVE-2022-23437)
| Summary: | CVE-2022-23437 xerces-j2: infinite loop when handling specially crafted XML document payloads | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alazarot, anstephe, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, eleandro, emingora, etirelli, fjuma, gzaronik, hhorak, ibek, iweiss, jclere, jochrist, jorton, jpallich, jperkins, jrokos, jstastny, jwon, krathod, krzysztof.daniel, kverlaen, kwills, lgao, mizdebsk, mnovotny, mosmerov, msochure, msvehla, nwallace, patrickm, pjindal, pmackay, rguimara, rhcs-maint, rrajasek, rstancel, rsvoboda, smaestri, szappis, tom.jenkinson, tzimanyi, yborgess |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | xerces-j2 2.12.2 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This issue causes the XercesJ XML parser to wait in an infinite loop, which may consume system resources for a prolonged duration, leading to a denial of service condition.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-06-06 19:20:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2065624, 2065625, 2065626, 2065627, 2065628, 2065631, 2065632 | ||
| Bug Blocks: | 2047198, 2047453 | ||
|
Description
Mauro Matteo Cascella
2022-01-27 11:43:37 UTC
Upstream issue: https://issues.apache.org/jira/browse/XERCESJ-1737 Likely upstream patch: https://svn.apache.org/viewvc?view=revision&revision=1897143 Created ant:1.10/xerces-j2 tracking bugs for this issue: Affects: fedora-all [bug 2065631] Created xerces-j2 tracking bugs for this issue: Affects: fedora-all [bug 2065632] This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-23437 This issue has been addressed in the following products: RHPAM 7.13.1 async Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813 |