Bug 1451960 - (CVE-2017-7503) CVE-2017-7503 EAP: XXE issue in TransformerFactory
CVE-2017-7503 EAP: XXE issue in TransformerFactory
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20170518,repor...
: Security
Depends On: 1451961
Blocks: 1439976
  Show dependency treegraph
 
Reported: 2017-05-17 22:23 EDT by Jason Shepherd
Modified: 2018-01-30 20:23 EST (History)
27 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jason Shepherd 2017-05-17 22:23:05 EDT
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
Comment 2 Jason Shepherd 2017-05-17 22:23:49 EDT
Created wildfly tracking bugs for this issue:

Affects: fedora-all [bug 1451961]
Comment 6 Martin Prpič 2017-05-18 04:08:39 EDT
Acknowledgments:

Name: Jason Shepherd (Red Hat Product Security), Katerina Novotna (Red Hat Quality Engineering)
Comment 11 Jason Shepherd 2017-08-28 20:52:15 EDT
It will be difficult to fix this issue in Xerces. The patch which contains the fix in OpenJDK contains many other related changes. It appears to be fixed in revision 292:7b89fed7212b of the jaxp repo, http://hg.openjdk.java.net/jdk8/jdk8/jaxp/

An alternative might be to remove Xerces from EAP. However it will be difficult to remove and still maintain support for IBM JDK, see https://issues.jboss.org/browse/WFCORE-2805?focusedCommentId=13447139&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13447139
Comment 12 Jason Shepherd 2018-01-30 20:23:45 EST
Mitigation:

This issue affects processing of XML content from an untrusted source using a javax.xml.transform.TransformerFactory. The only safe way to process untrusted XML content with a TransformerFactory is to use the StAX API. StAX is a safe implementation on EAP 7.0.x because the XML content is not read in it's entirety in order to parse it. As a developer using StAX, you decide which XML stream events you want to react to, so XXE control constructs won't be processed automatically by the parser.

Note You need to log in before you can comment on or make changes to this bug.