Bug 1075328 (CVE-2014-0054) - CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
Summary: CVE-2014-0054 Spring Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-0054
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1079030
Blocks: 1075354
TreeView+ depends on / blocked
 
Reported: 2014-03-12 04:16 UTC by Murray McAllister
Modified: 2021-10-20 10:44 UTC (History)
8 users (show)

Fixed In Version: spring mvc 3.2.8, spring mvc 4.0.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-20 10:44:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0400 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss Fuse 6.1.0 update 2014-04-14 18:27:37 UTC
Red Hat Product Errata RHSA-2014:0401 0 normal SHIPPED_LIVE Moderate: Red Hat JBoss A-MQ 6.1.0 update 2014-04-14 18:07:26 UTC

Description Murray McAllister 2014-03-12 04:16:26 UTC 
The fixes for the CVE-2013-7315 (bug 1061509) and CVE-2013-6429 (bug 1053290) XML External Entity (XXE) issues were found to be incomplete. From the original advisory:

"Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default."

This issue affects versions 3.0.0 to 3.2.8, and versions 4.0.0 to 4.0.1.

External References:

http://www.gopivotal.com/security/cve-2014-0054
Comment 3 Kurt Seifried 2014-03-20 20:17:24 UTC 
Statement:

The Red Hat Security Response Team has rated this issue as having Moderate security impact. OpenShift Enterprise 1 is currently in the Production 1 phase of its lifecycle, as such this issue is not currently planned to be addressed in future updates. For additional information, refer to the Satellite Life Cycle: https://access.redhat.com/site/support/policy/updates/openshift page.
Comment 4 Chess Hazlett 2014-04-15 02:37:32 UTC 
This issue has been addressed in following products:

  Red Hat JBoss AM-Q 6.1.0

Via RHSA-2014:0401 https://rhn.redhat.com/errata/RHSA-2014-0401.html
Comment 5 Chess Hazlett 2014-04-15 02:40:33 UTC 
This issue has been addressed in following products:

  Red Hat JBoss Fuse 6.1.0

Via RHSA-2014:0400 https://rhn.redhat.com/errata/RHSA-2014-0400.html
Comment 6 Kurt Seifried 2014-09-05 19:55:29 UTC 
This issue is being deferred for OpenShift Enterprise 2, only authenticated users have access to ActiveMQ (and thus the ability to exploit this Spring issue). A later update may address this issue.
Note You need to log in before you can comment on or make changes to this bug.