TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fmm9-3gv8-58f4
Summary: Improper Handling of Missing Values in kaml
Aliases: CVE-2021-39194
Severity: MODERATE
CWE: CWE-230, CWE-835
Published: 2021-09-07T23:08:40Z

### Impact
Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. 

This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected.

YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue, for example:

```yaml
!<x>
```

The following is a sample application that demonstrates this issue:

```kotlin
import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: String? = null,
    ) : K()
}

const val s = """
!<x>
"""

fun main() {
    println("Started.")
    val result = Yaml.default.decodeFromString(K.serializer(), s)
    println("Finished, result is $result")
}
```

On vulnerable versions of kaml, the `decodeFromString()` operation hangs and never returns. 


### Patches
Version 0.35.3 or later contain the fix for this issue.
Vulnerability: GHSA-5x3v-2gxr-59m2
Summary: Directory traversal in Apache RocketMQ
Aliases: CVE-2019-17572
Severity: MODERATE
CWE: CWE-22
Published: 2020-07-01T17:26:15Z

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
Vulnerability: GHSA-3rmv-2pg5-xvqj
Summary: High severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1275
Severity: CRITICAL
CWE: CWE-358, CWE-94
Published: 2018-10-17T20:28:00Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
Vulnerability: GHSA-p225-pc2x-4jpm
Summary: Incorrect Authorization in keycloak
Aliases: CVE-2020-1725
Severity: MODERATE
CWE: CWE-863, CWE-668
Published: 2022-02-09T00:58:52Z

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.
Vulnerability: GHSA-v585-23hc-c647
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36186
Severity: HIGH
CWE: CWE-502
Published: 2021-11-19T20:13:06Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-jfh8-c2jp-5v3q
Summary: Remote code injection in Log4j
Aliases: CVE-2021-44228
Severity: CRITICAL
CWE: CWE-502, CWE-20, CWE-400
Published: 2021-12-10T00:40:56Z

# Summary

Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.
As per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.

Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory.

# Impact

Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. 

# Affected versions

Any Log4J version prior to v2.15.0 is affected to this specific issue.

The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.

## Security releases
Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3

## Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

# Remediation Advice

## Updated advice for version 2.16.0

The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0).
Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33).

Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221).

Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.
Vulnerability: GHSA-j52r-xc68-q8f4
Summary: Insufficiently Protected Credentials in Pivotal Reactor Netty
Aliases: CVE-2019-11284
Severity: HIGH
CWE: CWE-522
Published: 2019-10-23T14:14:32Z

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Vulnerability: GHSA-fmj5-wv96-r2ch
Summary: Moderate severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2015-5262
Severity: MODERATE
Published: 2018-10-17T00:05:29Z

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Vulnerability: GHSA-7rjp-fgwj-47rw
Summary: Missing authentication in ShenYu
Aliases: CVE-2022-23945
Severity: HIGH
CWE: CWE-306, CWE-862
Published: 2022-01-28T22:14:11Z

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-j3ch-vjph-8q6v
Summary: Command injection in Alluxio
Aliases: CVE-2022-23848
Severity: CRITICAL
Published: 2022-02-21T00:00:19Z

In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.
Vulnerability: GHSA-35fr-h7jr-hh86
Summary: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
Severity: MODERATE
CWE: CWE-74, CWE-113
Published: 2019-12-06T18:55:47Z

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.

### Impact

1. Cross-User Defacement
2. Cache Poisoning
3. Cross-Site Scripting (XSS)
4. Page Hijacking


### Root Cause

The root cause is due to the usage of Netty without the HTTP header validation.

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23

### Patches

This vulnerability has been patched in 0.97.0.

### References

[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)
https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [GitHub](https://github.com/line/armeria/issues)
Vulnerability: GHSA-g7p8-r2ch-4rmf
Summary: Malicious Atomix node queries expose sensitive information
Aliases: CVE-2020-35215
Severity: MODERATE
CWE: CWE-668
Published: 2021-12-17T20:41:45Z

An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
Vulnerability: GHSA-j7xg-5549-jr3j
Summary: Improper Certificate Validation in OWASP ZAP
Aliases: CVE-2022-27820
Severity: MODERATE
CWE: CWE-295
Published: 2022-03-25T00:00:34Z

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
Vulnerability: GHSA-f6hm-88x3-mfjv
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-21349
Severity: MODERATE
CWE: CWE-502, CWE-918
Published: 2021-03-22T23:29:19Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21349](https://x-stream.github.io/CVE-2021-21349.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-4446-656p-f54g
Summary: Deserialization of Untrusted Data in Bouncy castle
Aliases: CVE-2018-1000613
Severity: CRITICAL
CWE: CWE-502, CWE-470
Published: 2018-10-17T16:23:12Z

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs version prior to version 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.
Vulnerability: GHSA-4gr7-qw2q-jxh6
Summary: Cross-site Scripting in Nacos
Aliases: CVE-2021-44667
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-12T00:00:27Z

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
Vulnerability: GHSA-g556-x5vx-qh59
Summary: Moderate severity vulnerability that affects com.caverock:androidsvg
Aliases: CVE-2017-1000498
Severity: HIGH
CWE: CWE-611
Published: 2018-10-19T16:50:33Z

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution
Vulnerability: GHSA-fvfc-8pqr-wjpv
Summary: Missing Authorization in Jenkins S3 publisher Plugin
Aliases: CVE-2021-21650
Severity: MODERATE
CWE: CWE-862
Published: 2021-06-16T17:29:08Z

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.
Vulnerability: GHSA-7chv-rrw6-w6fc
Summary: XStream is vulnerable to a Remote Command Execution attack
Aliases: CVE-2021-29505
Severity: HIGH
CWE: CWE-502, CWE-74, CWE-94
Published: 2021-05-18T18:36:27Z

### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.github.io/CVE-2021-29505.html).

### Credits

V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-mx7p-6679-8g3q
Summary: Polymorphic Typing in FasterXML jackson-databind
Aliases: CVE-2019-16942
Severity: CRITICAL
CWE: CWE-502
Published: 2019-10-28T20:51:15Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Vulnerability: GHSA-cmx4-p4v5-hmr5
Summary: Server-side request forgery (SSRF) in Apache Batik
Aliases: CVE-2019-17566
Severity: HIGH
CWE: CWE-20, CWE-918
Published: 2022-02-09T00:46:46Z

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-4jhc-wjr3-pwh2
Summary: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node.
Aliases: CVE-2020-35211
Severity: HIGH
Published: 2021-12-17T20:40:38Z

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
Vulnerability: GHSA-rrvg-2c69-p9rf
Summary: Cross-Site Request Forgery in Jenkins Xray 
Aliases: CVE-2021-21652
Severity: HIGH
CWE: CWE-352
Published: 2021-06-16T17:28:58Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Vulnerability: GHSA-2jx8-v4hv-gx3h
Summary: XXE vulnerability in Launch import
Aliases: CVE-2020-12642
Severity: HIGH
CWE: CWE-611
Published: 2021-06-28T16:45:47Z

| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk |
|--------------|-------------------|-------------------|---------------|---------------|
| Monday, May 4, 2020| [service-api](https://github.com/reportportal/service-api) | Every version, starting from 3.1.0 | Remote | Medium |

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Report Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.

We advise our users install the latest releases we built specifically to address this issue.

### Patches
Fixed with https://github.com/reportportal/service-api/pull/1201

### Binary Download
https://bintray.com/epam/reportportal/service-api/5.1.1
https://bintray.com/epam/reportportal/service-api/4.3.12

### Docker Container Download
* RP v4: `docker pull reportportal/service-api:4.3.12`
* RP v5: `docker pull reportportal/service-api:5.1.1`

### Acknowledgement
The issue was reported to Report Portal Team by an external security researcher.
Our Team thanks Julien M. for reporting the issue.

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Vulnerability: GHSA-38w8-h222-wrpp
Summary: Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Aliases: CVE-2022-25209
Severity: HIGH
CWE: CWE-611
Published: 2022-02-16T00:01:14Z

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-jqj4-r483-4gvr
Summary: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Severity: MODERATE
CWE: CWE-81
Published: 2021-04-19T14:48:51Z

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Vulnerability: GHSA-vf4q-8mr7-5c5c
Summary: Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation
Aliases: CVE-2017-12634
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-16T23:05:58Z

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Vulnerability: GHSA-rfx6-vp9g-rh7v
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2017-17485
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-18T17:42:48Z

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerability: GHSA-pgq6-ccqj-hpqr
Summary:  Elasticsearch privilege escalation issue
Aliases: CVE-2022-23708
Severity: MODERATE
CWE: CWE-269
Published: 2022-03-04T00:00:15Z

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.
Vulnerability: GHSA-8qfc-cvjp-mgpq
Summary: Moderate severity vulnerability that affects org.apache.ignite:ignite-core
Aliases: CVE-2016-6805
Severity: MODERATE
CWE: CWE-611
Published: 2018-10-16T20:53:31Z

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
Vulnerability: GHSA-2jhm-qp48-hv5j
Summary: Missing authorization in xwiki-platform
Aliases: CVE-2022-23621
Severity: MODERATE
CWE: CWE-862
Published: 2022-02-09T21:56:05Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString:

```
$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")
```

### Patches

It has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-18870

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-93jq-624g-4p9p
Summary: Moderate severity vulnerability that affects org.asynchttpclient:async-http-client
Aliases: CVE-2017-14063
Severity: HIGH
CWE: CWE-20
Published: 2018-10-19T16:50:50Z

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Vulnerability: GHSA-6hgr-2g6q-3rmc
Summary: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Severity: MODERATE
CWE: CWE-287
Published: 2021-04-22T16:11:26Z

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
Vulnerability: GHSA-x64g-4xx9-fh6x
Summary: Denial of Service in Cryptacular
Aliases: CVE-2020-7226
Severity: HIGH
CWE: CWE-770
Published: 2020-06-10T20:02:58Z

CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with &quot;new byte&quot; may depend on untrusted input within the header of encoded data.
Vulnerability: GHSA-vc89-hccf-rq55
Summary: Hash collision in typelevel jawn
Aliases: CVE-2022-21653
Severity: MODERATE
CWE: CWE-400, CWE-326
Published: 2022-01-06T23:48:35Z

### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
Vulnerability: GHSA-jf2m-435m-mxw8
Summary: High severity vulnerability that affects org.apache.hive:hive-jdbc
Aliases: CVE-2018-1282
Severity: CRITICAL
CWE: CWE-89
Published: 2018-11-21T22:24:34Z

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
Vulnerability: GHSA-6v9v-3f4c-cjgx
Summary: Untrusted Search Path in PostgreSQL
Aliases: CVE-2020-14350
Severity: MODERATE
CWE: CWE-426
Published: 2022-02-15T01:57:18Z

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.
Vulnerability: GHSA-j77q-2qqg-6989
Summary: High severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2017-5638
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-18T19:24:26Z

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Vulnerability: GHSA-pf38-cw3p-22q9
Summary: Keycloak is vulnerable to IDN homograph attack
Aliases: CVE-2021-3424
Severity: MODERATE
CWE: CWE-287
Published: 2022-04-28T21:00:21Z

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
Vulnerability: GHSA-5557-j87h-cvf4
Summary: Missing Authorization in jenkins xray-connector
Aliases: CVE-2021-21653
Severity: MODERATE
CWE: CWE-862
Published: 2021-06-16T17:29:26Z

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-jpxj-vgq5-prjc
Summary: OS command execution vulnerability in Docker Commons Plugin
Aliases: CVE-2022-20617
Severity: HIGH
CWE: CWE-78
Published: 2022-01-13T00:01:03Z

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
Vulnerability: GHSA-2x83-r56g-cv47
Summary: High severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2012-6153
Severity: HIGH
CWE: CWE-20
Published: 2018-10-17T00:05:15Z

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Vulnerability: GHSA-6g88-99wj-8mgg
Summary: Command injection in Apache Flink
Aliases: CVE-2020-1960
Severity: MODERATE
CWE: CWE-74
Published: 2021-05-21T19:20:35Z

A vulnerability in Apache Flink where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.
Vulnerability: GHSA-c538-924g-99q4
Summary: Session Fixation in Apache Zeppelin
Aliases: CVE-2017-12619
Severity: HIGH
CWE: CWE-384
Published: 2019-04-24T16:06:59Z

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
Vulnerability: GHSA-6mcm-j9cj-3vc3
Summary: Infinite loop in Apache MINA
Aliases: CVE-2021-41973
Severity: MODERATE
CWE: CWE-835
Published: 2021-11-03T17:30:35Z

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Vulnerability: GHSA-3448-vfvv-xp9g
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-17197
Severity: MODERATE
CWE: CWE-835
Published: 2018-12-26T17:45:07Z

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Vulnerability: GHSA-5hr6-vc97-qxxh
Summary: XML Injection in Crafter CMS Crafter Studio 3.0.1
Aliases: CVE-2017-15685
Severity: HIGH
CWE: CWE-91
Published: 2022-02-09T23:08:01Z

Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Vulnerability: GHSA-q44v-xc3g-v7jq
Summary: Moderate severity vulnerability that affects org.owasp.antisamy:antisamy
Aliases: CVE-2017-14735
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-18T17:22:11Z

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.
Vulnerability: GHSA-f5cf-f7px-xpmh
Summary: Moderate severity vulnerability that affects org.apache.qpid:proton-j
Aliases: CVE-2016-2166
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-16T19:50:27Z

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Vulnerability: GHSA-j7m2-58wv-9v79
Summary: Vulnerability in Torpedo Query
Aliases: CVE-2019-11343
Severity: CRITICAL
Published: 2022-02-10T20:47:29Z

Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
Vulnerability: GHSA-w5m2-299g-rff5
Summary: Page Compare Reflected Cross-site Scripting (XSS) vulnerability
Aliases: CVE-2022-28820
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-26T12:59:00Z

### Impact

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in `/apps/acs-commons/content/page-compare.html` endpoint via the `a` and `b` GET parameters. User input submitted via these parameters is not validated or sanitized.

An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in 5.2.0.

### Workarounds

None 

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Black Lantern Security.

https://hackerone.com/reports/1466020
Vulnerability: GHSA-xjrr-xv9m-4pw5
Summary: High severity vulnerability that affects com.alibaba:fastjson
Aliases: CVE-2017-18349
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-24T19:42:03Z

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
Vulnerability: GHSA-7q8g-gpfp-v8gx
Summary: Insertion of Sensitive Information into Log File in Apache NiFi
Aliases: CVE-2020-1942
Severity: HIGH
CWE: CWE-532, CWE-200
Published: 2022-01-06T20:40:58Z

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.
Vulnerability: GHSA-g2f6-v5qh-h2mq
Summary: Nexus Repository Manager 3 - Remote Code Execution 
Aliases: CVE-2020-10199
Severity: HIGH
CWE: CWE-917
Published: 2020-04-14T15:27:05Z

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Vulnerability: GHSA-pccr-q7v9-5f27
Summary: Improper Input Validation and Path Traversal in Apache Solr
Aliases: CVE-2021-44548
Severity: HIGH
CWE: CWE-20, CWE-22, CWE-40
Published: 2022-01-06T21:32:35Z

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.
Vulnerability: GHSA-w8rc-pgxq-x2cj
Summary: Negative charge in shopping cart in Shopizer
Aliases: CVE-2020-11007
Severity: CRITICAL
CWE: CWE-20
Published: 2020-04-22T20:59:26Z

### Impact
Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. 

### Patches
Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0

### Workarounds
Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.

### References
[Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
[Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html)
[Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a)
CVE Details below : 
[Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007)
[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)

### Credits
Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity
master program supervised by Yassine Ilmi
Vulnerability: GHSA-c58c-w527-h77p
Summary: Deserialization of untrusted data in Apache Cayenne
Aliases: CVE-2022-24289
Severity: HIGH
CWE: CWE-502
Published: 2022-02-12T00:00:48Z

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Vulnerability: GHSA-f256-j965-7f32
Summary: Possible request smuggling in HTTP/2 due missing validation of content-length
Aliases: CVE-2021-21409
Severity: MODERATE
CWE: CWE-444
Published: 2021-03-30T15:10:38Z

### Impact
The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1

This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. 

### Patches
This was fixed as part of 4.1.61.Final

### Workarounds
Validation can be done by the user before proxy the request by validating the header.
Vulnerability: GHSA-8j39-fgfp-vxh8
Summary: Moderate severity vulnerability that affects com.xuxueli:xxl-conf
Aliases: CVE-2018-20094
Severity: HIGH
CWE: CWE-22
Published: 2018-12-19T19:25:04Z

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
Vulnerability: GHSA-rvpc-w57p-q95f
Summary: HTTP Response Splitting in WSO2 transport-http
Aliases: CVE-2019-10797
Severity: MODERATE
CWE: CWE-113
Published: 2022-02-09T22:35:29Z

Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.
Vulnerability: GHSA-w4fj-ccr6-7pcp
Summary: Insertion of Sensitive Information into Log File in Apache NiFi
Aliases: CVE-2020-1928
Severity: MODERATE
CWE: CWE-532, CWE-200
Published: 2022-01-06T20:40:56Z

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Vulnerability: GHSA-h9gj-rqrw-x4fq
Summary: Server Side Request Forgery in Apache Axis
Aliases: CVE-2019-0227
Severity: HIGH
CWE: CWE-918
Published: 2019-05-14T04:02:24Z

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Vulnerability: GHSA-57j2-w4cx-62h2
Summary: Deeply nested json in jackson-databind
Aliases: CVE-2020-36518
Severity: HIGH
CWE: CWE-787
Published: 2022-03-12T00:00:36Z

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.
Vulnerability: GHSA-898j-5cc8-cmf5
Summary: Moderate severity vulnerability that affects org.apache.storm:storm-core
Aliases: CVE-2018-8008
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-16T17:35:24Z

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Vulnerability: GHSA-5p52-j8pw-j7x5
Summary: Moderate severity vulnerability that affects org.bedework:bw-webdav
Aliases: CVE-2018-20000
Severity: HIGH
CWE: CWE-611
Published: 2018-12-19T19:24:52Z

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.
Vulnerability: GHSA-q7q9-w24q-cpgh
Summary: Cross-site Scripting (XSS) in Apache Ambari Views
Aliases: CVE-2020-1936
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T20:35:22Z

A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Vulnerability: GHSA-hx83-rpqf-m267
Summary: user/group information can be corrupted across storing in fsimage and reading back from fsimage
Aliases: CVE-2018-11768
Severity: HIGH
CWE: CWE-119
Published: 2019-11-20T01:38:00Z

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
Vulnerability: GHSA-hxxp-6546-wv6r
Summary: Improper Restriction of XML External Entity Reference
Aliases: CVE-2021-21672
Severity: MODERATE
CWE: CWE-611
Published: 2021-07-02T18:36:13Z

Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-ph76-rhqq-xj7j
Summary: Cross-site scripting in Crafter CMS Crafter Studio
Aliases: CVE-2017-15686
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T23:08:06Z

Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
Vulnerability: GHSA-523c-xh4g-mh5m
Summary: Denial of Service in Apache POI
Aliases: CVE-2017-12626
Severity: HIGH
CWE: CWE-835
Published: 2021-01-14T19:18:22Z

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks:
  - Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294)
  - Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)
Vulnerability: GHSA-mf4f-j588-5xm8
Summary: Apache Log4j Remote Code Execution
Severity: CRITICAL
Published: 2021-12-14T21:07:14Z

### Impact

Opencast uses an Apache Log4j2 version which, combined with older JDK versions, can be used for remote code execution attacks which have been found to be actively exploited.

Apache Log4j2 <=2.14.1 JNDI features is not sufficiently protected. An attacker who can control log messages or log message parameters can execute arbitrary code when message lookup substitution is enabled.

### Who is affected

- Opencast before 9.10 or 10.6 are affected
    - Log4j version: all 2.x versions before 2.15.0 are affected

### Patches

The issue has been fixed in Opencast 9.10 and 10.6.

### Workarounds

The vulnerability can be mitigated by setting system property `log4j2.formatMsgNoLookups` to `true`.

### References

- [Opencast pull request mitigating the vulnerability](https://github.com/opencast/opencast/pull/3253)
- [CVE-2021-44228 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
- [Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability](https://www.veracode.com/blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228)
- [VE-2021-44228 – Log4j 2 Vulnerability Analysis](https://www.randori.com/blog/cve-2021-44228/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)


### Note about dependencies

This issue affects many Java applications. Please also verify these are not vulnerable.
Vulnerability: GHSA-vjv6-gq77-3mjw
Summary: XXE attack in Mapfish Print
Aliases: CVE-2020-15232
Severity: LOW
CWE: CWE-611
Published: 2020-07-07T16:32:45Z

### Impact
A user can do to an XML External Entity (XXE) attack with the provided SDL style.

### Patches
Use version >= 3.24

### Workarounds
No

### References
* https://cwe.mitre.org/data/definitions/611.html
* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e

### For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397
Vulnerability: GHSA-wfxp-4qgw-qp3c
Summary: XML external entity (XXE) attacks in Jenkins Xcode integration Plugin
Aliases: CVE-2021-21656
Severity: HIGH
CWE: CWE-611
Published: 2022-03-18T17:52:43Z

Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-x2p8-rgfm-qw3v
Summary: Access Control vulnerability within CoreNLP
Aliases: CVE-2021-44550
Severity: CRITICAL
CWE: CWE-863
Published: 2022-02-25T00:01:07Z

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
Vulnerability: GHSA-rrpm-pj7p-7j9q
Summary: Remote code execution affecting org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2018-1260
Severity: CRITICAL
CWE: CWE-94
Published: 2018-10-18T18:05:34Z

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contain a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.

This vulnerability exposes applications that meet all of the following requirements:
- Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer)
- Use the default Approval Endpoint

This vulnerability does not expose applications that:
- Act in the role of an Authorization Server but override the default Approval Endpoint
- Act in the role of a Resource Server only (e.g. @EnableResourceServer)
- Act in the role of a Client only (e.g. @EnableOAuthClient)
Vulnerability: GHSA-rc9v-h28f-jcmf
Summary: There is a XML external entity expansion (XXE) vulnerability in Apache Solr  config files
Aliases: CVE-2018-8010
Severity: MODERATE
CWE: CWE-611
Published: 2018-10-17T19:56:04Z

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs.