critical9.8
CVE-2022-28890
XML External Entity Reference in apache jena
Impact
A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.jena:jena | = 4.4.0 | 4.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Jena | Version 4.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
- https://github.com/advisories/GHSA-gchv-364h-r896
- https://nvd.nist.gov/vuln/detail/CVE-2022-28890
- https://jena.apache.org/about_jena/security-advisories.html#cve-2022-28890---processing-external-dtds