GHSA-rj4p-7mm6-gm9j

Source

https://github.com/advisories/GHSA-rj4p-7mm6-gm9j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rj4p-7mm6-gm9j/GHSA-rj4p-7mm6-gm9j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rj4p-7mm6-gm9j

Aliases

CVE-2011-1483

Published

2022-05-13T01:39:29Z

Modified

2023-11-08T03:56:59Z

Summary

JBossWS vulnerable to uncontrolled recursion

Details

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-11-08T12:35:06Z",
    "nvd_published_at":  "2013-07-29T13:59:00Z",
    "severity":  "LOW"
}

References

Affected packages

Maven / org.jboss.ws:jbossws-common

Package

Name: org.jboss.ws:jbossws-common; View open source insights on deps.dev
Purl: pkg:maven/org.jboss.ws/jbossws-common

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.1.0.Final

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rj4p-7mm6-gm9j/GHSA-rj4p-7mm6-gm9j.json"