Bug 2047200 (CVE-2022-23437) - CVE-2022-23437 xerces-j2: infinite loop when handling specially crafted XML document payloads
Summary: CVE-2022-23437 xerces-j2: infinite loop when handling specially crafted XML d...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-23437
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2065624 2065625 2065626 2065627 2065628 2065631 2065632
Blocks: 2047198 2047453
TreeView+ depends on / blocked
 
Reported: 2022-01-27 11:43 UTC by Mauro Matteo Cascella
Modified: 2024-02-06 04:35 UTC (History)
53 users (show)

Fixed In Version: xerces-j2 2.12.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This issue causes the XercesJ XML parser to wait in an infinite loop, which may consume system resources for a prolonged duration, leading to a denial of service condition.
Clone Of:
Environment:
Last Closed: 2022-06-06 19:20:40 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:4918 0 None None None 2022-06-06 15:52:22 UTC
Red Hat Product Errata RHSA-2022:4919 0 None None None 2022-06-06 15:58:47 UTC
Red Hat Product Errata RHSA-2022:4922 0 None None None 2022-06-06 15:12:08 UTC
Red Hat Product Errata RHSA-2022:6813 0 None None None 2022-10-05 10:45:16 UTC

Description Mauro Matteo Cascella 2022-01-27 11:43:37 UTC 
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

References:
https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
http://www.openwall.com/lists/oss-security/2022/01/24/3
Comment 1 Mauro Matteo Cascella 2022-03-18 11:01:24 UTC 
Upstream issue:
https://issues.apache.org/jira/browse/XERCESJ-1737

Likely upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1897143
Comment 3 Mauro Matteo Cascella 2022-03-18 11:32:55 UTC 
Created ant:1.10/xerces-j2 tracking bugs for this issue:

Affects: fedora-all [bug 2065631]


Created xerces-j2 tracking bugs for this issue:

Affects: fedora-all [bug 2065632]
Comment 6 errata-xmlrpc 2022-06-06 15:12:04 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922
Comment 7 errata-xmlrpc 2022-06-06 15:52:19 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918
Comment 8 errata-xmlrpc 2022-06-06 15:58:43 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919
Comment 9 Product Security DevOps Team 2022-06-06 19:20:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-23437
Comment 12 errata-xmlrpc 2022-10-05 10:45:11 UTC 
This issue has been addressed in the following products:

  RHPAM 7.13.1 async

Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813
Note You need to log in before you can comment on or make changes to this bug.