CVE-2022-23437

Опубликовано: 24 янв. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 7.1

EPSS Низкий

Описание

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Ссылки

http://www.openwall.com/lists/oss-security/2022/01/24/3
Mailing List
Third Party Advisory
https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
Mailing List
Vendor Advisory
https://security.netapp.com/advisory/ntap-20221028-0005/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/24/3
Mailing List
Third Party Advisory
https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
Mailing List
Vendor Advisory
https://security.netapp.com/advisory/ntap-20221028-0005/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:xerces-j:*:*:*:*:*:*:*:*

Версия до 2.12.1 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_asap:7.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*

Версия до 9.0 (исключая)

cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*

Версия до 9.0 (исключая)

cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*

Версия до 9.0 (исключая)

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

Версия от 8.0.6.0.0 (включая) до 8.0.9.0 (включая)

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*

Версия от 8.1.0.0 (включая) до 8.1.2.0 (исключая)

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*

Версия от 8.0.6.0.0 (включая) до 8.0.8.0 (включая)

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_universal_banking:12.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:*:*:*:*:*:*:*:*

Версия до 13.9.4.2.2 (исключая)

cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:13.9.4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*

Версия до 12.2.0.1.30 (исключая)

cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*

Версия от 3.0.1 (включая) до 3.0.5 (включая)

cpe:2.3:a:oracle:health_sciences_information_manager:3.0.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:ilearning:6.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:ilearning:6.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 17.7 (включая) до 17.12.11 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 18.8.0 (включая) до 18.8.14 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 19.12.0 (включая) до 19.12.13 (включая)

cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*

Версия от 20.12.0 (включая) до 20.12.8 (включая)

cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_financial_integration:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

EPSS

Процентиль: 25%

0.00087

Низкий

6.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

CWE-835

Связанные уязвимости

CVE-2022-23437

CVSS3: 6.5

ubuntu

около 4 лет назад

CVE-2022-23437

CVSS3: 6.5

redhat

около 4 лет назад

CVE-2022-23437

CVSS3: 6.5

debian

около 4 лет назад

There's a vulnerability within the Apache Xerces Java (XercesJ) XML pa ...

openSUSE-SU-2022:0503-1

suse-cvrf

почти 4 года назад

Security update for xerces-j2

openSUSE-SU-2022:0500-1

suse-cvrf

почти 4 года назад

Security update for xerces-j2

EPSS

Процентиль: 25%

0.00087

Низкий

6.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

CWE-835