GitHub Advisoryadvisory · Maven
GHSA-qh3m-qw6v-qvhg Moderate severity vulnerability that affects io.vertx:vertx-core
MEDIUM
Official page ↗
- Aliases
- CVE-2018-12544
- Ecosystem
- Maven
- Packages
- io.vertx:vertx-core
- Severity
- Moderate
- Weaknesses
- CWE-611
- Reviewed
- 2020-06-16
Affected packages
• Maven io.vertx:vertx-core: >= 3.5.0, < 3.5.4 → fixed in 3.5.4
Description
In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.
Related
Alias · CVE (1)
- CVE-2018-12544 In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense… vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-12544 advisory
- https://github.com/vert-x3/vertx-web/issues/1021 web
- https://github.com/vert-x3/vertx-web/commit/ac8692c618d6180a9bc012a2ac8dbec821b1a97 web
- https://access.redhat.com/errata/RHSA-2018:2946 web
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568 web
- https://github.com/advisories/GHSA-qh3m-qw6v-qvhg advisory
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E web