Bug 1143758 (CVE-2014-3643) - CVE-2014-3643 jersey: XXE via parameter entities
Summary: CVE-2014-3643 jersey: XXE via parameter entities
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-3643
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1143759
TreeView+ depends on / blocked
 
Reported: 2014-09-17 23:04 UTC by David Jorm
Modified: 2019-09-29 13:21 UTC (History)
5 users (show)

Fixed In Version: jersey 1.13
Clone Of:
Environment:
Last Closed: 2016-04-29 17:18:51 UTC
Embargoed:

Attachments (Terms of Use)

Description David Jorm 2014-09-17 23:04:42 UTC 
It was found that external parameter entities were not disabled by the jersey SAX parser. A remote attacker able to send XML requests to a jersey endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Comment 2 Kurt Seifried 2015-02-26 20:05:46 UTC 
I would like to propose notifying upstream and then unembargoing this issue in 1-2 weeks as it is only moderate severity and appears stalled. If there is a significant reason to leave this issue embargoed please let me know.
Comment 5 Chess Hazlett 2015-03-19 19:26:56 UTC 
unembargoed.
Note You need to log in before you can comment on or make changes to this bug.