critical9.1
CVE-2021-23926
Improper Restriction of Recursive Entity References in Apache XMLBeans
Impact
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.xmlbeans:xmlbeans | < 3.0.0 | 3.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Xmlbeans | through 2.6.0 |
| Netapp | Oncommand Unified Manager Core Package | All versions |
| Netapp | Snap Creator Framework | All versions |
| Netapp | Snapmanager | All versions |
| Debian | Debian Linux | Version 9.0 |
| Oracle | Middleware Common Libraries And Tools | Versions 12.2.1.3.0, 12.2.1.4.0 |
| Oracle | Peoplesoft Enterprise Peopletools | Versions 8.57, 8.58, 8.59 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://issues.apache.org/jira/browse/XMLBEANS-517
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed%40%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1%40%3Cjava-dev.axis.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html
- https://poi.apache.org/
- https://security.netapp.com/advisory/ntap-20210513-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://github.com/advisories/GHSA-mw3r-pfmg-xp92
- https://nvd.nist.gov/vuln/detail/CVE-2021-23926
- https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3E
- https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3E