Bug 1075328 – CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1075328 - (CVE-2014-0054) CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

Summary:	CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

Status:	NEW

Aliases:	CVE-2014-0054

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20140131,repor...
Keywords:	Security

Depends On:	1079030
Blocks:	1075354
	Show dependency tree / graph

Reported:	2014-03-12 00:16 EDT by Murray McAllister
Modified:	2018-06-29 18:00 EDT (History)
CC List:	8 users (show)

See Also:
Fixed In Version:	spring mvc 3.2.8, spring mvc 4.0.2
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0400	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Fuse 6.1.0 update	2014-04-14 14:27:37 EDT
Red Hat Product Errata	RHSA-2014:0401	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss A-MQ 6.1.0 update	2014-04-14 14:07:26 EDT

Groups: None (edit)

Description Murray McAllister 2014-03-12 00:16:26 EDT

The fixes for the CVE-2013-7315 (bug 1061509) and CVE-2013-6429 (bug 1053290) XML External Entity (XXE) issues were found to be incomplete. From the original advisory:

"Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default."

This issue affects versions 3.0.0 to 3.2.8, and versions 4.0.0 to 4.0.1.

External References:

http://www.gopivotal.com/security/cve-2014-0054

Comment 3 Kurt Seifried 2014-03-20 16:17:24 EDT

Statement:

The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.

Comment 4 Chess Hazlett 2014-04-14 22:37:32 EDT

This issue has been addressed in following products:

  Red Hat JBoss AM-Q 6.1.0

Via RHSA-2014:0401 https://rhn.redhat.com/errata/RHSA-2014-0401.html

Comment 5 Chess Hazlett 2014-04-14 22:40:33 EDT

This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.1.0

Via RHSA-2014:0400 https://rhn.redhat.com/errata/RHSA-2014-0400.html

Comment 6 Kurt Seifried 2014-09-05 15:55:29 EDT

This issue is being deferred for OpenShift Enterprise 2, only authenticated users have access to ActiveMQ (and thus the ability to exploit this Spring issue). A later update may address this issue.

Note You need to log in before you can comment on or make changes to this bug.