Bug 1406811 (CVE-2016-8739) - CVE-2016-8739 apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE
Summary: CVE-2016-8739 apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulner...
Keywords:
Status: NEW
Alias: CVE-2016-8739
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1406813
Blocks: 1406817
TreeView+ depends on / blocked
 
Reported: 2016-12-21 14:34 UTC by Andrej Nemec
Modified: 2019-09-29 14:03 UTC (History)
61 users (show)

Fixed In Version: apache-cxf 3.0.12, apache-cxf 3.1.9
Doc Type: If docs needed, set a value
Doc Text:
Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. It was found that this represents a major XXE risk.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0868 normal SHIPPED_LIVE Important: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update 2017-04-04 01:02:28 UTC

Description Andrej Nemec 2016-12-21 14:34:42 UTC
Apache CXF JAX-RS implementation provides a number of Atom MessageBodyReaders. These readers use Apache Abdera Parser to parse Atom feeds or Entries, with this Parser expanding XML entities by default. This represents a major XXE risk. 

External References:

http://cxf.apache.org/security-advisories.data/CVE-2016-8739.txt.asc?version=1&modificationDate=1482164360575&api=v2

Comment 1 Andrej Nemec 2016-12-21 14:35:32 UTC
Created cxf tracking bugs for this issue:

Affects: fedora-all [bug 1406813]

Comment 5 Jason Shepherd 2016-12-22 05:25:40 UTC
JBoss EAP 6 and 7 implement JAX-RS using Resteasy, not CXF. Therefore the vulnerable AbstractAtomProvider class is not part of either distribution. Setting EAP 6 and 7 layered productgs as not affected.

Comment 6 errata-xmlrpc 2017-04-03 21:03:44 UTC
This issue has been addressed in the following products:



Via RHSA-2017:0868 https://access.redhat.com/errata/RHSA-2017:0868

Comment 7 errata-xmlrpc 2018-07-02 15:51:42 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2017:0868 https://access.redhat.com/errata/RHSA-2017:0868


Note You need to log in before you can comment on or make changes to this bug.