Bug 1922102 (CVE-2021-23926) - CVE-2021-23926 xmlbeans: allowed malicious XML input may lead to XML Entity Expansion attack
Summary: CVE-2021-23926 xmlbeans: allowed malicious XML input may lead to XML Entity E...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-23926
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1922986
Blocks: 1922103
TreeView+ depends on / blocked
 
Reported: 2021-01-29 09:08 UTC by Marian Rehak
Modified: 2021-12-14 22:04 UTC (History)
58 users (show)

Fixed In Version: xmlbeans 3.0.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found when parsing XML files using XMLBeans 2.6.0 or below. The underlying parser created by XMLBeans could be susceptible to XML External Entity (XXE) attacks. The highest threat from this vulnerability is to confidentiality and system availability.
Clone Of:
Environment:
Last Closed: 2021-12-14 22:04:59 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:5134 0 None None None 2021-12-14 21:33:26 UTC

Description Marian Rehak 2021-01-29 09:08:26 UTC 
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks.

Reference:

https://issues.apache.org/jira/browse/XMLBEANS-517
Comment 8 Jonathan Christison 2021-02-01 13:43:27 UTC 
Red Hat have rated this vulnerability as having an Important impact, although the current CVSS scoring from NVD (9.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) suggests this is a critical issue Red Hat flaw handling policies (https://access.redhat.com/security/updates/classification) requires arbitrary code execution by a remote unauthenticated attacker to be classed as critical, in this case it is not possible for an attacker to run arbitrary code using the XXE flaw alone.
Comment 12 RaTasha Tillery-Smith 2021-02-03 16:49:48 UTC 
Mitigation:

Affected users are advised to update to Apache XMLBeans 3.0.0 or above, which fixes this vulnerability.
Comment 15 Jonathan Christison 2021-02-10 15:14:43 UTC 
Marking Red Hat JBoss Fuse 6 and Red Hat Fuse 7 as having a moderate impact, this is because although vulnerable versions of xmlbeans are distributed, it is by default not used by fuse application itself, end applications may use xmlbeans via camel-xmlbeans but it is not a first-choice component for XML java mapping and we would advise users of camel-xmlbeans not to parse any XML that is derived from untrusted or uncontrolled sources.
Comment 19 errata-xmlrpc 2021-12-14 21:33:23 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
Comment 20 Product Security DevOps Team 2021-12-14 22:04:55 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-23926
Note You need to log in before you can comment on or make changes to this bug.