CVE-2022-28890 - Processing external DTDs

Back Back to CVE browser

CRITICAL

Processing external DTDs

Published May 5, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 2.67%

Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Affected products

Vendor Apache Software Foundation Product Apache Jena Default
n/a
- Version
  Apache Jena
  Status
  affected
  Constraints
  <=4.4.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Jena

n/a

Version	Status	Constraints
Apache Jena	affected	<=4.4.0

Remediation

Vendor solution

Users are advised to upgrade to Apache Jena 4.5.0 or later.

Weaknesses (1)

CWE-611

XXE

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3938
Advisory
https://github.com/advisories/GHSA-gchv-364h-r896
Advisory
https://jena.apache.org/about_jena/security-advisories.html#cve-2022-28890---processing-external-dtds
https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
x_refsource_MISCMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-28890

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3938		Advisory
https://github.com/advisories/GHSA-gchv-364h-r896		Advisory
https://jena.apache.org/about_jena/security-advisories.html#cve-2022-28890---processing-external-dtds
https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878		x_refsource_MISCMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-28890