Description

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

Remediation

References

https://github.com/vert-x3/vertx-web/issues/1021

https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568

https://access.redhat.com/errata/RHSA-2018:2946

https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E

Related Vulnerabilities

CVE-2022-4244 Vulnerability in maven package org.codehaus.plexus:plexus-utils

CVE-2020-36649 Vulnerability in maven package org.webjars.bower:papaparse

CVE-2022-31023 Vulnerability in maven package com.typesafe.play:play_2.13

CVE-2022-31198 Vulnerability in npm package @openzeppelin/contracts

CVE-2020-28196 Vulnerability in npm package node-krb5

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Issue Tracking Vendor Advisory