CVE-2018-12544

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-12544

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12544.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-12544

Aliases

GHSA-qh3m-qw6v-qvhg

Published

2018-10-10T20:29:00Z

Modified

2026-07-08T17:56:14Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

References

Affected packages

Git / github.com/eclipse-vertx/vert.x

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-vertx/vert.x

Events

Introduced

9460cabbf623945495e6108c9d1979a9e7b5d8e7

Last Affected

4c5ea4d082ab02093ba9eb85fcde47a37059eb5d

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:eclipse:vert.x:3.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.2:cr1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.2:cr2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.2:cr3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:vert.x:3.5.3:cr1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "last_affected": "3.5.0"
        },
        {
            "introduced": "3.5.0-beta1"
        },
        {
            "last_affected": "3.5.0-beta1"
        },
        {
            "introduced": "3.5.1"
        },
        {
            "last_affected": "3.5.1"
        },
        {
            "introduced": "3.5.2"
        },
        {
            "last_affected": "3.5.2"
        },
        {
            "introduced": "3.5.2-cr1"
        },
        {
            "last_affected": "3.5.2-cr1"
        },
        {
            "introduced": "3.5.2-cr2"
        },
        {
            "last_affected": "3.5.2-cr2"
        },
        {
            "introduced": "3.5.2-cr3"
        },
        {
            "last_affected": "3.5.2-cr3"
        },
        {
            "introduced": "3.5.3"
        },
        {
            "last_affected": "3.5.3"
        },
        {
            "introduced": "3.5.3-cr1"
        },
        {
            "last_affected": "3.5.3-cr1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.5.0

3.5.0-beta1

3.5.1

3.5.2

3.5.2-cr1

3.5.2-cr2

3.5.2-cr3

3.5.2.CR1

3.5.2.CR2

3.5.2.CR3

3.5.3

3.5.3-cr1

3.5.3.CR1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12544.json"

Git / github.com/vert-x3/vertx-web