GitHub Advisoryadvisory · Maven

GHSA-rj4p-7mm6-gm9j JBossWS vulnerable to uncontrolled recursion

LOW Published 2022-05-13 Modified 2022-11-08 Official page ↗
Aliases
CVE-2011-1483
Ecosystem
Maven
Packages
org.jboss.ws:jbossws-common
Severity
Low
Weaknesses
CWE-400
Reviewed
2022-11-08

Affected packages

• Maven org.jboss.ws:jbossws-common: < 2.1.0.Final → fixed in 2.1.0.Final

Description

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Related

Alias · CVE (1)

  • CVE-2011-1483 wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References