Bug 2172069 (CVE-2014-125087)

Summary:	CVE-2014-125087 java-xmlbuilder: XMLBuilder2 is vulnerable to XML External Entity (XXE) injection
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	aileenc, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, cmiranda, darran.lofthouse, dkreling, dosoudil, fjuma, fmariani, ggrzybek, gmalinko, hbraun, istudens, ivassile, iweiss, janstey, jcantril, jpavlik, jpoth, lgao, mosmerov, msochure, msvehla, nwallace, pcongius, pdelbell, peholase, periklis, pesilva, pjindal, pmackay, rojacob, rstancel, rstepani, smaestri, tcunning, tom.jenkinson, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	java-xmlbuilder 1.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in java-xmlbuilder. The manipulation leads to an XML external entity (XXE) reference.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-24 09:11:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2171902

Description Avinash Hanwate 2023-02-21 11:39:55 UTC

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.

https://vuldb.com/?id.221480
https://vuldb.com/?ctiid.221480
https://github.com/jmurty/java-xmlbuilder/issues/6
https://github.com/jmurty/java-xmlbuilder/releases/tag/v1.2
https://github.com/jmurty/java-xmlbuilder/commit/e6fddca201790abab4f2c274341c0bb8835c3e73

Comment 5 Product Security DevOps Team 2023-05-24 09:11:22 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2014-125087