5:21 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Bug ID: 1801149
Summary: CVE-2019-13990 libquartz-java: XXE attacks via job
description
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bkearney(a)redhat.com, btotty(a)redhat.com,
chazlett(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gvarsami(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lef(a)fedoraproject.org, lzap(a)redhat.com,
mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sbonazzo(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com,
sokeeffe(a)redhat.com, tbrisker(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in initDocumentParser in
xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through
2.3.0 allows XXE attacks via a job description.
Reference:
https://github.com/quartz-scheduler/quartz/issues/467
https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115a...
https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432d...
https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679...
https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046...
https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3...
--
You are receiving this mail because:
You are on the CC list for the bug.
5:23 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Dhananjay Arunesh <darunesh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1801151
Summary|CVE-2019-13990 |CVE-2019-13990 libquartz:
|libquartz-java: XXE attacks |XXE attacks via job
|via job description |description
--
You are receiving this mail because:
You are on the CC list for the bug.
10:51 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |quartz-2.3.2
--
You are receiving this mail because:
You are on the CC list for the bug.
6:30 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Cedric Buissart 🐶 <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1807886
--
You are receiving this mail because:
You are on the CC list for the bug.
11:45 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1814511, 1814510
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1814510
[Bug 1814510] CVE-2019-13990 quartz: libquartz: XXE attacks via job description
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
11:45 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #6 from Doran Moppert <dmoppert(a)redhat.com> ---
Created quartz tracking bugs for this issue:
Affects: fedora-all [bug 1814510]
--
You are receiving this mail because:
You are on the CC list for the bug.
9:37 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Barnaby Court <bcourt(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |NOTABUG
Last Closed| |2020-03-23 14:37:23
--- Comment #8 from Barnaby Court <bcourt(a)redhat.com> ---
We quartz as an embedded library and do not use the relevant XML based job
creation that is affected by this CVE.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:39 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Barnaby Court <bcourt(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|NOTABUG |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
9:53 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Cedric Buissart 🐶 <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |NEW
Resolution|WONTFIX |---
Keywords| |Reopened
--
You are receiving this mail because:
You are on the CC list for the bug.
10 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #9 from Cedric Buissart 🐶 <cbuissar(a)redhat.com> ---
Statement:
Red Hat Satellite 6 uses a vulnerable version of libquartz as a dependency for
candlepin. However, the <job><descrition> entry is not used, and the
vulnerability can not be triggered. An update may fix the code in the future.
--
You are receiving this mail because:
You are on the CC list for the bug.
8:40 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Ted (Jong Seok) Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|medium |high
Severity|medium |high
--
You are receiving this mail because:
You are on the CC list for the bug.
3 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Rolfe Dlugy-Hegwer <rdlugyhe(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rdlugyhe(a)redhat.com,
| |security-response-team@redh
| |at.com
Flags| |needinfo?(security-response
| |-team(a)redhat.com)
--
You are receiving this mail because:
You are on the CC list for the bug.
12:56 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Yogendra Jog <yjog(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |dmoppert(a)redhat.com
Flags|needinfo?(security-response |needinfo?(dmoppert(a)redhat.c
|-team(a)redhat.com) |om)
--
You are receiving this mail because:
You are on the CC list for the bug.
12:52 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A flaw was found in quartz through version 2.3.0. A XXE attack is possible in the
Terracotta Quartz Scheduler using a job description. The highest threat from this
vulnerability is to data confidentiality and integrity as well as system availability.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:07 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #14 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
--
You are receiving this mail because:
You are on the CC list for the bug.
1:08 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3196
--
You are receiving this mail because:
You are on the CC list for the bug.
1:23 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #15 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
--
You are receiving this mail because:
You are on the CC list for the bug.
1:23 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3197
--
You are receiving this mail because:
You are on the CC list for the bug.
2:27 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed|2020-03-23 14:37:23 |2020-07-29 07:27:42
--- Comment #16 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-13990
--
You are receiving this mail because:
You are on the CC list for the bug.
8:15 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #17 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Virtualization Engine 4.4
Via RHSA-2020:3247 https://access.redhat.com/errata/RHSA-2020:3247
--
You are receiving this mail because:
You are on the CC list for the bug.
8:15 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3247
--
You are receiving this mail because:
You are on the CC list for the bug.
1:30 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Bug 1801149 depends on bug 1814510, which changed state.
Bug 1814510 Summary: CVE-2019-13990 quartz: libquartz: XXE attacks via job description
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1814510
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |EOL
--
You are receiving this mail because:
You are on the CC list for the bug.
6:13 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.8.0
Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
--
You are receiving this mail because:
You are on the CC list for the bug.
6:13 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:5568
--
You are receiving this mail because:
You are on the CC list for the bug.
2:04 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI <trathi(a)redhat.com> ---
A flaw was found in quartz through version 2.3.0. A XXE attack is possible in the
Terracotta Quartz Scheduler using a job description. The highest threat from this
vulnerability is to data confidentiality, integrity as well as system availability.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
7:42 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com> ---
A flaw was found in Quartz through version 2.3.0. An XML external entity attack (XXE) is
possible in the Terracotta Quartz Scheduler using a job description, affecting data
confidentiality, integrity, and system availability.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
10:02 p.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI <trathi(a)redhat.com> ---
A flaw was found in Quartz. An XML external entity attack (XXE) is possible in the
Terracotta Quartz Scheduler using a job description, affecting data confidentiality,
integrity, and system availability.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
12:19 a.m.
New subject: [Bug 1801149] CVE-2019-13990 libquartz: XXE attacks via job description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI <trathi(a)redhat.com> ---
The Terracotta Quartz Scheduler is susceptible to an XML external entity attack (XXE)
through a job description. This issue stems from inadequate handling of XML external
entity (XXE) declarations in the initDocumentParser function within
xml/XMLSchedulingDataProcessor.java. By enticing a victim to access a maliciously crafted
job description (containing XML content), a remote attacker could exploit this
vulnerability to execute an XXE attack on the targeted system.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
83
days inactive
1536
days old
java-sig-commits@lists.fedoraproject.org
27 comments
1 participants
participants (1)
-
bugzilla＠redhat.com