[Bug 1973413] New: CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
2:02 p.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug ID: 1973413
Summary: CVE-2021-33813 jdom: XXE allows attackers to cause a
DoS via a crafted HTTP request
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, bbaranow(a)redhat.com,
bibryam(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dbhole(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
fjuma(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jrokos(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mat.booth(a)gmail.com,
mizdebsk(a)redhat.com, mkoncek(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msrb(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, sd-operator-metering(a)redhat.com,
smaestri(a)redhat.com, sochotni(a)redhat.com,
spinder(a)redhat.com, sponnaga(a)redhat.com,
tcunning(a)redhat.com, tflannag(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a
denial of service via a crafted HTTP request.
References:
https://alephsecurity.com/vulns/aleph-2021003
http://jdom.org/news/index.html
Upstream patch:
https://github.com/hunterhacker/jdom/pull/188
--
You are receiving this mail because:
You are on the CC list for the bug.
2:03 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1973417
Depends On| |1973414, 1973415, 1973416
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1973414
[Bug 1973414] CVE-2021-33813 jdom2: jdom: XXE allows attackers to cause a DoS
via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973415
[Bug 1973415] CVE-2021-33813 javapackages-bootstrap: jdom: XXE allows attackers
to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973416
[Bug 1973416] CVE-2021-33813 javapackages-tools: jdom: XXE allows attackers to
cause a DoS via a crafted HTTP request [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
2:03 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created javapackages-bootstrap tracking bugs for this issue:
Affects: fedora-all [bug 1973415]
Created javapackages-tools tracking bugs for this issue:
Affects: fedora-all [bug 1973416]
Created jdom2 tracking bugs for this issue:
Affects: fedora-all [bug 1973414]
--
You are receiving this mail because:
You are on the CC list for the bug.
2:13 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1973557, 1973558
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1973557
[Bug 1973557] CVE-2021-33813 javapackages-bootstrap:202001/jdom2: jdom: XXE
allows attackers to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973558
[Bug 1973558] CVE-2021-33813 javapackages-tools:202001/jdom2: jdom: XXE allows
attackers to cause a DoS via a crafted HTTP request [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
2:14 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #2 from Tomas Hoger <thoger(a)redhat.com> ---
Created javapackages-bootstrap:202001/jdom2 tracking bugs for this issue:
Affects: fedora-all [bug 1973557]
Created javapackages-tools:202001/jdom2 tracking bugs for this issue:
Affects: fedora-all [bug 1973558]
--
You are receiving this mail because:
You are on the CC list for the bug.
3:19 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #4 from Todd Cullum <tcullum(a)redhat.com> ---
FYI - In jdom (not jdom2), it seems that this vulnerable functionality is in
the setFeaturesAndProperties() private method, but in jdom2, it was moved into
configureParser() and setFeaturesAndProperties() was removed. E.G. older code
from jdom-1.1.3:
```
private void setFeaturesAndProperties(XMLReader parser, boolean coreFeatures)
throws JDOMException {
Iterator iter = this.features.keySet().iterator();
while (iter.hasNext()) {
String name = iter.next();
Boolean value = (Boolean)this.features.get(name);
internalSetFeature(parser, name, value.booleanValue(), name);
}
iter = this.properties.keySet().iterator();
while (iter.hasNext()) {
String name = iter.next();
internalSetProperty(parser, name, this.properties.get(name), name);
}
if (coreFeatures) {
try {
internalSetFeature(parser, "http://xml.org/sax/features/validation",
this.validate, "Validation");
} catch (JDOMException e) {
if (this.validate)
throw e;
}
internalSetFeature(parser, "http://xml.org/sax/features/namespaces",
true, "Namespaces");
internalSetFeature(parser,
"http://xml.org/sax/features/namespace-prefixes", true, "Namespace
prefixes");
}
try {
if
(parser.getFeature("http://xml.org/sax/features/external-general-enti... !=
this.expand)
parser.setFeature("http://xml.org/sax/features/external-general-enti...;,
this.expand);
} catch (SAXNotRecognizedException sAXNotRecognizedException) {
} catch (SAXNotSupportedException sAXNotSupportedException) {}
}
private void internalSetFeature(XMLReader parser, String feature, boolean
value, String displayName) throws JDOMException {
try {
parser.setFeature(feature, value);
} catch (SAXNotSupportedException e) {
throw new JDOMException(displayName + " feature not supported for SAX
driver " + parser
.getClass().getName());
} catch (SAXNotRecognizedException e) {
throw new JDOMException(displayName + " feature not recognized for SAX
driver " + parser
.getClass().getName());
}
}
```
--
You are receiving this mail because:
You are on the CC list for the bug.
3:38 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Todd Cullum <tcullum(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1975521, 1975522, 1975520,
| |1975523
--
You are receiving this mail because:
You are on the CC list for the bug.
10:57 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Todd Cullum <tcullum(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1975878, 1975877
--
You are receiving this mail because:
You are on the CC list for the bug.
12:42 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Todd Cullum <tcullum(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1976298, 1976299
--
You are receiving this mail because:
You are on the CC list for the bug.
6:05 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug 1973413 depends on bug 1973414, which changed state.
Bug 1973414 Summary: CVE-2021-33813 jdom2: jdom: XXE allows attackers to cause a DoS via a
crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973414
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
2:59 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug 1973413 depends on bug 1973557, which changed state.
Bug 1973557 Summary: CVE-2021-33813 javapackages-bootstrap:202001/jdom2: jdom: XXE allows
attackers to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973557
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
2:59 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug 1973413 depends on bug 1973558, which changed state.
Bug 1973558 Summary: CVE-2021-33813 javapackages-tools:202001/jdom2: jdom: XXE allows
attackers to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973558
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
3:22 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #19 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHINT Camel-K 1.6.4
Via RHSA-2022:1029 https://access.redhat.com/errata/RHSA-2022:1029
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
3:22 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1029
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
8 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #20 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHPAM 7.12.1
Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
8 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1108
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
8:16 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #21 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
RHDM 7.12.1
Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
8:16 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:1110
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
11:01 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #22 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-33813
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
11:01 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |ERRATA
Status|NEW |CLOSED
Last Closed| |2022-03-29 16:01:17
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
6:47 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug 1973413 depends on bug 1973415, which changed state.
Bug 1973415 Summary: CVE-2021-33813 javapackages-bootstrap:202001/jdom: XXE allows
attackers to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973415
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |EOL
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
6:48 p.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
Bug 1973413 depends on bug 1973416, which changed state.
Bug 1973416 Summary: CVE-2021-33813 javapackages-tools:202001/jdom: XXE allows attackers
to cause a DoS via a crafted HTTP request [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1973416
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |EOL
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
9:20 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
--- Comment #23 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
9:20 a.m.
New subject: [Bug 1973413] CVE-2021-33813 jdom: XXE allows attackers to cause a DoS via a crafted HTTP request
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:5532
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1973413
695
days inactive
1080
days old
java-sig-commits@lists.fedoraproject.org
23 comments
1 participants
participants (1)
-
bugzilla＠redhat.com