Bug 1065199 (CVE-2014-1868) - CVE-2014-1868 Restlet: DoS due to XML entity expansion
Summary: CVE-2014-1868 Restlet: DoS due to XML entity expansion
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-1868
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1064676
TreeView+ depends on / blocked
 
Reported: 2014-02-14 05:31 UTC by David Jorm
Modified: 2021-02-17 06:52 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-02-14 05:40:16 UTC
Embargoed:

Attachments (Terms of Use)

Description David Jorm 2014-02-14 05:31:20 UTC 
It was found that Restlet applications which use XMLRepresentation or XML serializers, as provided by various extensions, are vulnerable to XML entity expansion attacks. A remote attacker could use this flaw to perform a denial of service attack through CPU or memory exhaustion.
Comment 1 David Jorm 2014-02-14 05:39:44 UTC 
Upstream bug:

https://github.com/restlet/restlet-framework-java/issues/826

External References:

https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements
http://restlet.org/learn/2.1/changes

Statement:

Not affected. Restlet as shipped with various Red Hat products does not include any of the extensions affected by this flaw.
Note You need to log in before you can comment on or make changes to this bug.