Bug 1328427 – CVE-2016-3720 jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1328427 - (CVE-2016-3720) CVE-2016-3720 jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack

Summary:	CVE-2016-3720 jackson-dataformat-xml: XmlMapper is vulnerable to XXE attack

Status:	CLOSED CURRENTRELEASE

Aliases:	CVE-2016-3720

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160504,repor...
Keywords:	Security

Depends On:	1332726 1332727
Blocks:	1328429
	Show dependency tree / graph

Reported:	2016-04-19 07:23 EDT by Adam Mariš
Modified:	2016-09-23 02:53 EDT (History)
CC List:	5 users (show)

See Also:
Fixed In Version:	jackson-dataformat-xml 2.7.4
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-09-23 00:10:09 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Adam Mariš 2016-04-19 07:23:36 EDT

It was reported that XmlMapper in jackson-dataformat-xml is vulnerable to XXE attack ("Improper Restriction of XML External Entity Reference").

Comment 1 Adam Mariš 2016-04-19 07:23:40 EDT

Acknowledgments:

Name: Adith Sudhakar

Comment 3 Jason Shepherd 2016-05-03 18:48:06 EDT

Created jberet tracking bugs for this issue:

Affects: fedora-all [bug 1332726]

Comment 4 Jason Shepherd 2016-05-03 18:48:11 EDT

Created jackson-dataformat-xml tracking bugs for this issue:

Affects: fedora-all [bug 1332727]

Comment 6 Fedora Update System 2016-05-10 07:46:39 EDT

jackson-dataformat-xml-2.6.3-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2016-05-15 01:30:42 EDT

jackson-dataformat-xml-2.5.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2016-05-16 10:53:59 EDT

jackson-dataformat-xml-2.5.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Adam Mariš 2016-06-22 10:01:35 EDT

Upstream bug:

https://github.com/FasterXML/jackson-dataformat-xml/issues/190

Fixed in jackson-dataformat-xml 2.7.4

Comment 10 Brett Cave 2016-07-13 10:47:03 EDT

Who is responsible for updating the CVE / who initially submitted it? A check run against the database still shows 2.7.4 as vulnerable. 

On the upstream issue, the maintainers state that they were not involved with filing the CVE.

Comment 11 Brett Cave 2016-07-13 10:48:34 EDT

Is the CVE failing due to this issue still reflecting as "NEW". Should the status of this bug stay as New?

Comment 12 Tatu Saloranta 2016-08-16 13:59:09 EDT

Is there any chance to get status updated: Fixed (as per comments above) in 2.7.4, as well as 2.8.0 (and all later versions). As the author of Jackson I can provide more details if and as needed, but I am not sure what can be done at this point.

Comment 13 Jason Shepherd 2016-09-23 00:10:09 EDT

This flaw had the 'fixedin' field set to 2.7.4 since 22nd June, 2016. It seems they field is not being read by NVD. You might need to contact them directly.

Note You need to log in before you can comment on or make changes to this bug.