oss-sec mailing list archives
[ANNOUNCE] CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack exposure
From: Marshall Schor <schor () apache org>
Date: Thu, 26 Apr 2018 12:11:06 -0400
CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack exposure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - uimaj 2.x.x releases prior to 2.10.2 - uimaj 3.0.0 releases prior to 3.0.0-beta - uima-as releases prior to 2.10.2 - uimaFIT releases prior to 2.4.0 - uimaDUCC releases prior to 2.2.2 Description. The details of this vulnerability were reported to the Apache UIMA Private mailing list. This vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. See https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing for more details. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content. Mitigation: Users are advised to upgrade these UIMA components to the following levels or later: - uimaj: 2.x.x upgrade to 2.10.2 or later - uimaj: 3.x.x upgrade to 3.0.0 or later - uima-as: upgrade to 2.10.2 or later - uimaFIT: upgrade to 2.4.0 or later - uimaDUCC: upgrade to 2.2.2 or later Credit: Joern Kottmann -Marshall Schor, on behalf of the UIMA Project Management Committee
Current thread:
- [ANNOUNCE] CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack exposure Marshall Schor (Apr 26)