GitHub Advisoryadvisory · Maven

GHSA-gchv-364h-r896 XML External Entity Reference in apache jena

CRITICAL Published 2022-05-06 Modified 2023-10-13 Official page ↗
Aliases
CVE-2022-28890
Ecosystem
Maven
Packages
org.apache.jena:jena
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2022-05-24

Affected packages

• Maven org.apache.jena:jena: >= 4.4.0, < 4.5.0 → fixed in 4.5.0

Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Related

Alias · CVE (1)

  • CVE-2022-28890 A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References