Bug 2294737 (CVE-2024-38374)

Summary:	CVE-2024-38374 cyclonedx-core-java: XML External Entity injection while evaluating XPath expressions
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anstephe, arnavarr, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, chfoley, clement.escoffier, dandread, darran.lofthouse, dkreling, dosoudil, fjuma, fmariani, gmalinko, gsmet, hamadhan, istudens, ivassile, iweiss, janstey, jmartisk, jpoth, jscholz, lgao, lthon, max.andersen, mosmerov, msochure, mstefank, msvehla, nwallace, olubyans, pgallagh, pjindal, pmackay, probinso, rjohnson, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, smaestri, swoodman, tcunning, tom.jenkinson, tqvarnst, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cyclonedx-core-java 9.0.4	Doc Type:	---
Doc Text:	A flaw was found in cyclonedx-core-java. It is vulnerable to XML External Entity (XXE) injection due to an insecure configuration of the `DocumentBuilderFactory` used to evaluate XPath expressions.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2294738

Description Pedro Sampaio 2024-06-28 19:13:45 UTC

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.

References:

https://github.com/CycloneDX/cyclonedx-core-java/pull/434
https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d
https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8