CVE-2018-12544

Опубликовано: 10 окт. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

Ссылки

https://access.redhat.com/errata/RHSA-2018:2946
Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568
Issue Tracking
Patch
Vendor Advisory
https://github.com/vert-x3/vertx-web/issues/1021
Patch
Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
https://access.redhat.com/errata/RHSA-2018:2946
Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568
Issue Tracking
Patch
Vendor Advisory
https://github.com/vert-x3/vertx-web/issues/1021
Patch
Third Party Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:eclipse:vert.x:3.5.0:*:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.0:beta1:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.1:*:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.2:*:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.2:cr1:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.2:cr2:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.2:cr3:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.3:*:*:*:*:*:*:*

cpe:2.3:a:eclipse:vert.x:3.5.3:cr1:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00618

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

CVE-2018-12544

CVSS3: 6.5

redhat

больше 7 лет назад

GHSA-qh3m-qw6v-qvhg

github