Описание
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss BRMS 5 | Security | Affected | ||
| JBEAP 4.2.0 for RHEL 4 | jbossas | Fixed | RHSA-2011:1309 | 15.09.2011 |
| JBEAP 4.2.0 for RHEL 5 | jbossas | Fixed | RHSA-2011:1309 | 15.09.2011 |
| JBEWP 5 for RHEL 5 | jbossws-common | Fixed | RHSA-2011:1303 | 15.09.2011 |
| JBEWP 5 for RHEL 6 | jbossws-common | Fixed | RHSA-2011:1303 | 15.09.2011 |
| JBoss Communications Platform 1.2 | Fixed | RHSA-2011:1308 | 15.09.2011 | |
| JBoss Communications Platform 5.1 | Fixed | RHSA-2011:1308 | 15.09.2011 | |
| JBoss Enterprise BRMS Platform 5.1 | Fixed | RHSA-2011:1313 | 15.09.2011 | |
| Red Hat JBoss Enterprise Application Platform 4.2 | Fixed | RHSA-2011:1310 | 15.09.2011 | |
| Red Hat JBoss Enterprise Application Platform 4.3 | Fixed | RHSA-2011:1307 | 15.09.2011 |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS2
Связанные уязвимости
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
EPSS
5 Medium
CVSS2