GHSA-78vv-qj73-h9m5
Improper Restriction of Recursive Entity References in DTDs in Apache POI
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2017-5644
- CVSS_V3
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.poi:poi | introduced 0, fixed 3.15 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2017-5644 ADVISORY
- https://www.oracle.com/security-alerts/cpuoct2020.html WEB
- http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15 WEB
- http://www.securityfocus.com/bid/96983 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |