GitHub Advisoryadvisory · Maven

GHSA-w3gh-g32m-cvhr High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3

HIGH Published 2018-10-18 Modified 2020-06-16 Official page ↗
Aliases
CVE-2018-8038
Ecosystem
Maven
Packages
org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, org.apache.cxf.fediz:fediz-spring3, org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9
Severity
High
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• Maven org.apache.cxf.fediz:fediz-spring: < 1.4.4 → fixed in 1.4.4 • Maven org.apache.cxf.fediz:fediz-spring2: < 1.4.4 → fixed in 1.4.4 • Maven org.apache.cxf.fediz:fediz-spring3: < 1.4.4 → fixed in 1.4.4 • Maven org.apache.cxf.fediz:fediz-jetty8: < 1.4.4 → fixed in 1.4.4 • Maven org.apache.cxf.fediz:fediz-jetty9: < 1.4.4 → fixed in 1.4.4

Description

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

Related

Alias · CVE (1)

  • CVE-2018-8038 Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References