GHSA-rj4p-7mm6-gm9j
JBossWS vulnerable to uncontrolled recursion
At a glance
- Published
- Updated
- CVE
- CVE-2011-1483
Description
DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jboss.ws:jbossws-common | introduced 0, fixed 2.1.0.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-1483 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=692584 WEB
- https://github.com/jbossws/jbossws-common PACKAGE
- http://source.jboss.org/changelog/JBossWS/?cs=13996 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |