Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

Remediation

References

https://lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878

Related Vulnerabilities

CVE-2015-8858 Vulnerability in maven package org.webjars.npm:uglify-js

CVE-2021-25641 Vulnerability in maven package org.apache.dubbo:dubbo

CVE-2020-6422 Vulnerability in maven package org.webjars.npm:electron

CVE-2019-10318 Vulnerability in maven package org.jenkins-ci.plugins:azure-ad

CVE-2023-4863 Vulnerability in npm package electron

Severity

Critical

Classification

CWE-611 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Vendor Advisory