Bug 1378673 (CVE-2016-7051) - CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack
Summary: CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-7051
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1380205 1380206
Blocks: 1378674
TreeView+ depends on / blocked
 
Reported: 2016-09-23 03:47 UTC by Jason Shepherd
Modified: 2021-10-21 00:55 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 00:55:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Jason Shepherd 2016-09-23 03:47:22 UTC 
A flaw was found in jackson-dataformat-xml's XmlMapper which allows XXE Out of Band attack. An attacker could use this flaw to launch a SSRF attack.
Comment 1 Jason Shepherd 2016-09-23 03:47:27 UTC 
Acknowledgments:

Name: Adith Sudhakar
Comment 3 Jason Shepherd 2016-09-28 23:31:42 UTC 
Created jberet tracking bugs for this issue:

Affects: fedora-all [bug 1380205]
Comment 4 Jason Shepherd 2016-09-28 23:31:47 UTC 
Created jackson-dataformat-xml tracking bugs for this issue:

Affects: fedora-all [bug 1380206]
Comment 5 Salvatore Bonaccorso 2016-12-20 17:10:51 UTC 
Hi

Is this a duplicate of CVE-2016-3720?

Regards,
Salvatore
Comment 6 Kurt Seifried 2016-12-25 19:21:57 UTC 
(In reply to Salvatore Bonaccorso from comment #5)
> Hi
> 
> Is this a duplicate of CVE-2016-3720?
> 
> Regards,
> Salvatore

Good questions. Resetting NEEDINFO to amaris, he assigned CVE-2016-7051 in response to jsheppard, I've looked at the bugs but it's a bit convoluted. I've also emailed them to ensure they see this.
Comment 7 Jason Shepherd 2017-01-03 00:57:23 UTC 
These 2 issues are distinct. The first issues was about XXE, and was fixed with the change in line 115 here:

https://github.com/FasterXML/jackson-dataformat-xml/blob/master/src/main/java/com/fasterxml/jackson/dataformat/xml/XmlFactory.java

The second issue was about DTD, and was fixed with the change in line 117.
Comment 8 Salvatore Bonaccorso 2017-01-05 20:50:02 UTC 
Thanks for the clarification.
Note You need to log in before you can comment on or make changes to this bug.