Bug 1451960 (CVE-2017-7503) - CVE-2017-7503 EAP: XXE issue in TransformerFactory
Summary: CVE-2017-7503 EAP: XXE issue in TransformerFactory
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7503
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1451961
Blocks: 1439976
TreeView+ depends on / blocked
 
Reported: 2017-05-18 02:23 UTC by Jason Shepherd
Modified: 2020-06-15 17:20 UTC (History)
44 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
Clone Of:
Environment:
Last Closed: 2020-06-15 17:20:26 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2563 None None None 2020-06-15 16:17:08 UTC

Description Jason Shepherd 2017-05-18 02:23:05 UTC
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.

Comment 2 Jason Shepherd 2017-05-18 02:23:49 UTC
Created wildfly tracking bugs for this issue:

Affects: fedora-all [bug 1451961]

Comment 6 Martin Prpič 2017-05-18 08:08:39 UTC
Acknowledgments:

Name: Jason Shepherd (Red Hat Product Security), Katerina Novotna (Red Hat Quality Engineering)

Comment 11 Jason Shepherd 2017-08-29 00:52:15 UTC
It will be difficult to fix this issue in Xerces. The patch which contains the fix in OpenJDK contains many other related changes. It appears to be fixed in revision 292:7b89fed7212b of the jaxp repo, http://hg.openjdk.java.net/jdk8/jdk8/jaxp/

An alternative might be to remove Xerces from EAP. However it will be difficult to remove and still maintain support for IBM JDK, see https://issues.jboss.org/browse/WFCORE-2805?focusedCommentId=13447139&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13447139

Comment 12 Jason Shepherd 2018-01-31 01:23:45 UTC
Mitigation:

This issue affects processing of XML content from an untrusted source using a javax.xml.transform.TransformerFactory. The only safe way to process untrusted XML content with a TransformerFactory is to use the StAX API. StAX is a safe implementation on EAP 7.0.x because the XML content is not read in it's entirety in order to parse it. As a developer using StAX, you decide which XML stream events you want to react to, so XXE control constructs won't be processed automatically by the parser.

Comment 19 errata-xmlrpc 2020-06-15 16:17:03 UTC
This issue has been addressed in the following products:

  EAP-CD 14 Tech Preview

Via RHSA-2020:2563 https://access.redhat.com/errata/RHSA-2020:2563

Comment 20 Product Security DevOps Team 2020-06-15 17:20:26 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-7503


Note You need to log in before you can comment on or make changes to this bug.