Bug 1973413 (CVE-2021-33813) - CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
Summary: CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP r...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-33813
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1973414 1973415 1973416 1973557 1973558 1975520 1975521 1975522 1975523 1975877 1975878 1976298 1976299
Blocks: 1973417
TreeView+ depends on / blocked
 
Reported: 2021-06-17 19:02 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-07-07 14:20 UTC (History)
79 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-03-29 16:01:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:1029 0 None None None 2022-03-23 08:22:56 UTC
Red Hat Product Errata RHSA-2022:1108 0 None None None 2022-03-29 13:00:38 UTC
Red Hat Product Errata RHSA-2022:1110 0 None None None 2022-03-29 13:16:52 UTC
Red Hat Product Errata RHSA-2022:5532 0 None None None 2022-07-07 14:20:35 UTC

Description Guilherme de Almeida Suckevicz 2021-06-17 19:02:36 UTC 
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

References:
https://alephsecurity.com/vulns/aleph-2021003
http://jdom.org/news/index.html

Upstream patch:
https://github.com/hunterhacker/jdom/pull/188
Comment 1 Guilherme de Almeida Suckevicz 2021-06-17 19:03:19 UTC 
Created javapackages-bootstrap tracking bugs for this issue:

Affects: fedora-all [bug 1973415]


Created javapackages-tools tracking bugs for this issue:

Affects: fedora-all [bug 1973416]


Created jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973414]
Comment 2 Tomas Hoger 2021-06-18 07:14:01 UTC 
Created javapackages-bootstrap:202001/jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973557]


Created javapackages-tools:202001/jdom2 tracking bugs for this issue:

Affects: fedora-all [bug 1973558]
Comment 4 Todd Cullum 2021-06-23 20:19:22 UTC 
FYI - In jdom (not jdom2), it seems that this vulnerable functionality is in the setFeaturesAndProperties() private method, but in jdom2, it was moved into configureParser() and setFeaturesAndProperties() was removed. E.G. older code from jdom-1.1.3:

```
private void setFeaturesAndProperties(XMLReader parser, boolean coreFeatures) throws JDOMException {
    Iterator iter = this.features.keySet().iterator();
    while (iter.hasNext()) {
      String name = iter.next();
      Boolean value = (Boolean)this.features.get(name);
      internalSetFeature(parser, name, value.booleanValue(), name);
    } 
    iter = this.properties.keySet().iterator();
    while (iter.hasNext()) {
      String name = iter.next();
      internalSetProperty(parser, name, this.properties.get(name), name);
    } 
    if (coreFeatures) {
      try {
        internalSetFeature(parser, "http://xml.org/sax/features/validation", this.validate, "Validation");
      } catch (JDOMException e) {
        if (this.validate)
          throw e; 
      } 
      internalSetFeature(parser, "http://xml.org/sax/features/namespaces", true, "Namespaces");
      internalSetFeature(parser, "http://xml.org/sax/features/namespace-prefixes", true, "Namespace prefixes");
    } 
    try {
      if (parser.getFeature("http://xml.org/sax/features/external-general-entities") != this.expand)
        parser.setFeature("http://xml.org/sax/features/external-general-entities", this.expand); 
    } catch (SAXNotRecognizedException sAXNotRecognizedException) {
    
    } catch (SAXNotSupportedException sAXNotSupportedException) {}
  }
  
  private void internalSetFeature(XMLReader parser, String feature, boolean value, String displayName) throws JDOMException {
    try {
      parser.setFeature(feature, value);
    } catch (SAXNotSupportedException e) {
      throw new JDOMException(displayName + " feature not supported for SAX driver " + parser
          .getClass().getName());
    } catch (SAXNotRecognizedException e) {
      throw new JDOMException(displayName + " feature not recognized for SAX driver " + parser
          .getClass().getName());
    } 
  }
```
Comment 19 errata-xmlrpc 2022-03-23 08:22:51 UTC 
This issue has been addressed in the following products:

  RHINT Camel-K 1.6.4

Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
Comment 20 errata-xmlrpc 2022-03-29 13:00:32 UTC 
This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108
Comment 21 errata-xmlrpc 2022-03-29 13:16:47 UTC 
This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110
Comment 22 Product Security DevOps Team 2022-03-29 16:01:12 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-33813
Comment 23 errata-xmlrpc 2022-07-07 14:20:30 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
Note You need to log in before you can comment on or make changes to this bug.