cnvd - cnvd-2022-38521

cnvd-2022-38521

Vulnerability from cnvd

Title: Apache Jena XML外部实体注入漏洞（CNVD-2022-38521）

Description:

Apache Jena是美国阿帕奇（Apache）基金会的一个Java语义网框架。用于构建语义Web和链接数据应用程序。

Apache Jena存在XML外部实体注入漏洞，该漏洞源于网络系统或产品未设置正确的过滤允许引用外部实体，远程攻击者可利用该漏洞通过发送特制的XML文件读取文件。

Severity: 高

Patch Name: Apache Jena XML外部实体注入漏洞（CNVD-2022-38521）的补丁

Patch Description:

Apache Jena是美国阿帕奇（Apache）基金会的一个Java语义网框架。用于构建语义Web和链接数据应用程序。

Apache Jena存在XML外部实体注入漏洞，该漏洞源于网络系统或产品未设置正确的过滤允许引用外部实体，远程攻击者可利用该漏洞通过发送特制的XML文件读取文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-28890

Impacted products

Name
['Apache Apache Jena <4.2.0', 'Apache Apache Jena 4.4.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-28890",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-28890"
    }
  },
  "description": "Apache Jena\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2aJava\u8bed\u4e49\u7f51\u6846\u67b6\u3002\u7528\u4e8e\u6784\u5efa\u8bed\u4e49Web\u548c\u94fe\u63a5\u6570\u636e\u5e94\u7528\u7a0b\u5e8f\u3002\n\nApache Jena\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u8bbe\u7f6e\u6b63\u786e\u7684\u8fc7\u6ee4\u5141\u8bb8\u5f15\u7528\u5916\u90e8\u5b9e\u4f53\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684XML\u6587\u4ef6\u8bfb\u53d6\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-38521",
  "openTime": "2022-05-19",
  "patchDescription": "Apache Jena\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2aJava\u8bed\u4e49\u7f51\u6846\u67b6\u3002\u7528\u4e8e\u6784\u5efa\u8bed\u4e49Web\u548c\u94fe\u63a5\u6570\u636e\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nApache Jena\u5b58\u5728XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u8bbe\u7f6e\u6b63\u786e\u7684\u8fc7\u6ee4\u5141\u8bb8\u5f15\u7528\u5916\u90e8\u5b9e\u4f53\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684XML\u6587\u4ef6\u8bfb\u53d6\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Jena XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2022-38521\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Apache Jena \u003c4.2.0",
      "Apache Apache Jena 4.4.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-28890",
  "serverity": "\u9ad8",
  "submitTime": "2022-05-09",
  "title": "Apache Jena XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2022-38521\uff09"
}

CVE-2022-28890 (GCVE-0-2022-28890)

Vulnerability from cvelistv5

Published

2022-05-05 08:40

Modified

2024-08-03 06:10

Severity ?

CWE

XML External DTD vulnerability

Summary

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

References

▼	URL	Tags
	https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Jena	Version: Apache Jena <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:10:56.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Jena",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "4.4.0",
              "status": "affected",
              "version": "Apache Jena",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Apache Jena would like to thank Feras Daragma, Avishag Shapira \u0026 Amit Laish (GE Digital, Cyber Security Lab) for their report."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "medium"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XML External DTD vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-05T08:40:09",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Processing external DTDs",
      "workarounds": [
        {
          "lang": "en",
          "value": "Users are advised to upgrade to Apache Jena 4.5.0 or later."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-28890",
          "STATE": "PUBLIC",
          "TITLE": "Processing external DTDs"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Jena",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Jena",
                            "version_value": "4.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Apache Jena would like to thank Feras Daragma, Avishag Shapira \u0026 Amit Laish (GE Digital, Cyber Security Lab) for their report."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "medium"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "XML External DTD vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Users are advised to upgrade to Apache Jena 4.5.0 or later."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-28890",
    "datePublished": "2022-05-05T08:40:09",
    "dateReserved": "2022-04-09T00:00:00",
    "dateUpdated": "2024-08-03T06:10:56.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted