[jira] [Commented] (XERCESJ-1679) xercesImpl: Security threat CVE-2013-4002

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[jira] [Commented] (XERCESJ-1679) xercesImpl: Security threat CVE-2013-4002

JIRA xerces-j-dev@xml.apache.org

    [ https://issues.apache.org/jira/browse/XERCESJ-1679?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16107542#comment-16107542 ]

Ari Elias-Bachrach commented on XERCESJ-1679:
---------------------------------------------

I know this is a closed issue, but if anyone else is in the same boat and needs an updated version to satisfy compliance requirements, someone did make an updated version and upload it to maven central under the version 2.11.1.  You can see it here: https://mvnrepository.com/artifact/com.rackspace.apache/xerces2-xsd11/2.11.1

> xercesImpl: Security threat CVE-2013-4002
> -----------------------------------------
>
>                 Key: XERCESJ-1679
>                 URL: https://issues.apache.org/jira/browse/XERCESJ-1679
>             Project: Xerces2-J
>          Issue Type: Bug
>    Affects Versions: 2.4.0, 2.11.0
>            Reporter: Mark Symons
>            Priority: Critical
>             Fix For: 2.12.0
>
>
> CVE-2013-4002 is a CVE that implicates Java... but was later realised to really be caused by Xerces.
> This is picked up as a "Security-High" vulnerability by Sonatype Nexus IQ analysis, who provide the following background info:
> {quote}
> h3.Description from CVE
> Unspecified vulnerability in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 allows remote attackers to affect availability via unknown vectors.
> h3.Explanation
> A flaw found in the way Xerces handles the processing of XML declarations allows for a Denial of service(DOS) attack while the server application processes the XML supplied by the remote user. Xerces is used as the built-in XML parser for certain versions of Java, hence the Java Runtime Environment was implicated in the CVE description. If this component showed up on a scan, then it is not because of the Java Runtime Environment.
> h3.Detection
> You are vulnerable if your application uses Xerces to parse untrusted and/or user-created XML.
> h3.Recommendation
> There is no non vulnerable version of this component at the time of this writing, but a fix was committed to the SVN repository. However, the last release was in 2013. Consider updating to the latest Java and switching to JAXP which is now part of the official JDK as of version 1.6
> h3.Root Cause
> xercesImpl-2.11.0.jar <= XMLScanner.class : [, 2.12)
> {quote}



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]