Description

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

Remediation

References

https://github.com/vert-x3/vertx-web/issues/1021

https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568

https://access.redhat.com/errata/RHSA-2018:2946

https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E

Related Vulnerabilities

CVE-2021-35517 Vulnerability in maven package org.apache.commons:commons-compress

CVE-2023-25826 Vulnerability in maven package net.opentsdb:opentsdb

CVE-2020-7746 Vulnerability in npm package chart.js

CVE-2021-41182 Vulnerability in maven package org.webjars.npm:jquery-ui

CVE-2012-5883 Vulnerability in npm package yui

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Issue Tracking Vendor Advisory