cnvd - cnvd-2019-43399

cnvd-2019-43399

Vulnerability from cnvd

Title: Eclipse Vert.xXML外部实体注入漏洞

Description:

Eclipse Vert.x是Eclipse基金会的一个用于在JVM上构建响应式应用程序的工具包，它主要用于构建网络实用程序、Web应用程序、HTTP/REST微服务等应用程序。

Eclipse Vert.x中的‘isValid’函数存在XML外部实体注入漏洞。目前没有详细的漏洞细节提供。

Severity: 高

Patch Name: Eclipse Vert.xXML外部实体注入漏洞的补丁

Patch Description:

Eclipse Vert.x是Eclipse基金会的一个用于在JVM上构建响应式应用程序的工具包，它主要用于构建网络实用程序、Web应用程序、HTTP/REST微服务等应用程序。

Eclipse Vert.x中的‘isValid’函数存在XML外部实体注入漏洞。目前没有详细的漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568

Reference: https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568

Impacted products

Name
Eclipse Vert.x >=3.5.Beta1，<=3.5.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-12544",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12544"
    }
  },
  "description": "Eclipse Vert.x\u662fEclipse\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u5728JVM\u4e0a\u6784\u5efa\u54cd\u5e94\u5f0f\u5e94\u7528\u7a0b\u5e8f\u7684\u5de5\u5177\u5305\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u6784\u5efa\u7f51\u7edc\u5b9e\u7528\u7a0b\u5e8f\u3001Web\u5e94\u7528\u7a0b\u5e8f\u3001HTTP/REST\u5fae\u670d\u52a1\u7b49\u5e94\u7528\u7a0b\u5e8f\u3002\n\nEclipse Vert.x\u4e2d\u7684\u2018isValid\u2019\u51fd\u6570\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://bugs.eclipse.org/bugs/show_bug.cgi?id=539568",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-43399",
  "openTime": "2019-12-03",
  "patchDescription": "Eclipse Vert.x\u662fEclipse\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u5728JVM\u4e0a\u6784\u5efa\u54cd\u5e94\u5f0f\u5e94\u7528\u7a0b\u5e8f\u7684\u5de5\u5177\u5305\uff0c\u5b83\u4e3b\u8981\u7528\u4e8e\u6784\u5efa\u7f51\u7edc\u5b9e\u7528\u7a0b\u5e8f\u3001Web\u5e94\u7528\u7a0b\u5e8f\u3001HTTP/REST\u5fae\u670d\u52a1\u7b49\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nEclipse Vert.x\u4e2d\u7684\u2018isValid\u2019\u51fd\u6570\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Eclipse Vert.xXML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Eclipse Vert.x  \u003e=3.5.Beta1\uff0c\u003c=3.5.3"
  },
  "referenceLink": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568",
  "serverity": "\u9ad8",
  "submitTime": "2018-10-12",
  "title": "Eclipse Vert.xXML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2018-12544 (GCVE-0-2018-12544)

Vulnerability from cvelistv5

Published

2018-10-10 20:00

Modified

2024-08-05 08:38

Severity ?

CWE

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2018:2946	vendor-advisory, x_refsource_REDHAT
	https://github.com/vert-x3/vertx-web/issues/1021	x_refsource_CONFIRM
	https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	The Eclipse Foundation	Eclipse Vert.x	Version: 3.5.0 < unspecified Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:06.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:2946",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2946"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vert-x3/vertx-web/issues/1021"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568"
          },
          {
            "name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Eclipse Vert.x",
          "vendor": "The Eclipse Foundation",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.5.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-10-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-16T05:06:24",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "name": "RHSA-2018:2946",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2946"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vert-x3/vertx-web/issues/1021"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568"
        },
        {
          "name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eclipse.org",
          "ID": "CVE-2018-12544",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Eclipse Vert.x",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "3.5.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "3.5.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "The Eclipse Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611: Improper Restriction of XML External Entity Reference (\u0027XXE\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:2946",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2946"
            },
            {
              "name": "https://github.com/vert-x3/vertx-web/issues/1021",
              "refsource": "CONFIRM",
              "url": "https://github.com/vert-x3/vertx-web/issues/1021"
            },
            {
              "name": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568",
              "refsource": "CONFIRM",
              "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568"
            },
            {
              "name": "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2018-12544",
    "datePublished": "2018-10-10T20:00:00",
    "dateReserved": "2018-06-18T00:00:00",
    "dateUpdated": "2024-08-05T08:38:06.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted