Описание
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | xercesimpl | Not affected | ||
| Red Hat CodeReady Studio 12 | xercesimpl | Not affected | ||
| Red Hat JBoss A-MQ 6 | xercesimpl | Out of support scope | ||
| Red Hat JBoss BRMS 6 | xercesimpl | Out of support scope | ||
| Red Hat JBoss Data Grid 7 | xercesimpl | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | xercesimpl | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 5 | xercesimpl | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | xercesimpl | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | xercesimpl | Out of support scope | ||
| Red Hat JBoss Fuse 6 | xercesimpl | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.
A flaw was found in Wildfly's implementation of Xerces, specifically i ...
Уязвимость класса XMLSchemaValidator компонента JAXP программного средства WildFly (JBoss Application Server), позволяющая нарушителю получить доступ на чтение, изменение, добавление или удаление данных с помощью многочисленных сетевых протоколов
EPSS
5.3 Medium
CVSS3