[MAVEN:GHSA-P99P-726H-C8V5] Apache juddi-client vulnerable to XML External Entity (XXE)

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 1

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.

Package	Affected Version
pkg:maven/org.apache.juddi/juddi-client	>= 3.2, < 3.3.5

Package	Fixed Version
pkg:maven/org.apache.juddi/juddi-client	= 3.3.5

ID: MAVEN:GHSA-P99P-726H-C8V5
Severity: high
URL: https://github.com/advisories/GHSA-p99p-726h-c8v5
Published: 2018-10-19T16:42:15
(6 years ago)
Modified: 2023-01-09T05:03:46
(20 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2018-1307
			https://github.com/advisories/GHSA-p99p-726h-c8v5
			https://issues.apache.org/jira/browse/JUDDI-987
			http://juddi.apache.org/security.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/org.apache.juddi/juddi-client	org.apache.juddi	juddi-client	>= 3.2 < 3.3.5
Fixed	pkg:maven/org.apache.juddi/juddi-client	org.apache.juddi	juddi-client	= 3.3.5

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date