Bug 1053290 – CVE-2013-6429 Spring Framework: XML External Entity (XXE) injection flaw

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1053290 - (CVE-2013-6429) CVE-2013-6429 Spring Framework: XML External Entity (XXE) injection flaw

Summary:	CVE-2013-6429 Spring Framework: XML External Entity (XXE) injection flaw

Status:	CLOSED ERRATA

Aliases:	CVE-2013-6429

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140114,repor...
Keywords:	Security

Depends On:	1054605 1054606
Blocks:	1026176 1053291
	Show dependency tree / graph

Reported:	2014-01-14 17:48 EST by David Jorm
Modified:	2015-02-13 05:27 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-02-11 12:49:47 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0400	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Fuse 6.1.0 update	2014-04-14 14:27:37 EDT
Red Hat Product Errata	RHSA-2014:0401	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss A-MQ 6.1.0 update	2014-04-14 14:07:26 EDT

Groups: None (edit)

Description David Jorm 2014-01-14 17:48:04 EST

It was found that the Spring MVC SourceHttpMessageConverter processed user-provided XML, and did not expose any property for disabling entity resolution in the XML. A remote attacker could use this flaw to conduct XML External Entity (XXE) attacks on web sites, and read files in the context of the user running the application server. The patch for this flaw disables external entity processing by default, and provides a configuration directive to re-enable it. This flaw is considered to be the result of an incomplete fix for CVE-2013-4152.

Comment 1 Vincent Danen 2014-01-14 18:25:43 EST

The upstream git commit to correct this issue is here:

https://github.com/spring-projects/spring-framework/commit/2ae6a6a3415eebc57babcb9d3e5505887eda6d8a


External References:

http://www.gopivotal.com/security/cve-2013-6429

Comment 4 Chess Hazlett 2014-04-14 22:36:31 EDT

This issue has been addressed in following products:

  Red Hat JBoss AM-Q 6.1.0

Via RHSA-2014:0401 https://rhn.redhat.com/errata/RHSA-2014-0401.html

Comment 5 Chess Hazlett 2014-04-14 22:39:19 EDT

This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.1.0

Via RHSA-2014:0400 https://rhn.redhat.com/errata/RHSA-2014-0400.html

Note You need to log in before you can comment on or make changes to this bug.