Infinite Loop in Apache Xerces Java

MITTEL 6.5CVE-2022-23437 · GHSA-h65f-jvqw-m9fj · Published 24/01/2022 · updated 08/10/2026

Kurz gesagt

CVE-2022-23437 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in xerces:xercesImpl, xerces-j (apache), agile engineering data management (oracle).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 11.6%, höher als bei 96.0% aller Schwachstellen.
Abhilfe: auf 2.12.2, 9.0, 8.1.2.0, 13.9.4.2.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
xerces:xercesImpl Maven	`< 2.12.2`	`2.12.2`
xerces-j apache	`≤ 2.12.1`	No fix yet
agile engineering data management oracle	`= 6.2.1.0`	No fix yet
agile product lifecycle management oracle	`= 9.3.6`	No fix yet
banking deposits and lines of credit servicing oracle	`= 2.7`	No fix yet
banking party management oracle	`= 2.7.0`	No fix yet
communications asap oracle	`= 7.3`	No fix yet
communications element manager oracle	`< 9.0`	`9.0`
communications session report manager oracle	`< 9.0`	`9.0`
communications session route manager oracle	`< 9.0`	`9.0`
financial services analytical applications infrastructure oracle	`≥ 8.0.6.0.0, ≤ 8.0.9.0≥ 8.1.0.0, < 8.1.2.0`	`8.1.2.0`
financial services behavior detection platform oracle	`= 8.1.1.0= 8.1.1.1= 8.1.2.0≥ 8.0.6.0.0, ≤ 8.0.8.0`	No fix yet
financial services crime and compliance management studio oracle	`= 8.0.8.2.0= 8.0.8.3.0`	No fix yet
financial services enterprise case management oracle	`= 8.0.7.1= 8.0.7.2.0= 8.0.8.0= 8.0.8.1= 8.1.1.0= 8.1.1.1`	No fix yet
flexcube universal banking oracle	`= 12.4.0`	No fix yet
global lifecycle management nextgen oui framework oracle	`= 13.9.4.2.2< 13.9.4.2.2`	`13.9.4.2.2`
global lifecycle management opatch oracle	`< 12.2.0.1.30`	`12.2.0.1.30`
health sciences information manager oracle	`= 3.0.0.1≥ 3.0.1, ≤ 3.0.5`	No fix yet
ilearning oracle	`= 6.2= 6.3`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.58= 8.59`	No fix yet
primavera gateway oracle	`≥ 17.7, ≤ 17.12.11≥ 18.8.0, ≤ 18.8.14≥ 19.12.0, ≤ 19.12.13≥ 20.12.0, ≤ 20.12.8`	No fix yet
product lifecycle analytics oracle	`= 3.6.1`	No fix yet
retail bulk data integration oracle	`= 16.0.3.0`	No fix yet
retail extract transform and load oracle	`= 13.2.8`	No fix yet
retail financial integration oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1`	No fix yet
retail integration bus oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1`	No fix yet
retail merchandising system oracle	`= 16.0.3= 19.0.1`	No fix yet
retail service backbone oracle	`= 14.1.3.2= 15.0.3.1= 16.0.3= 19.0.1`	No fix yet
weblogic server oracle	`= 12.2.1.3.0= 12.2.1.4.0= 14.1.1.0.0`	No fix yet

Description

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23437 · ADVISORY
jboss/xerces · PACKAGE
lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl · WEB
security.netapp.com/advisory/ntap-20221028-0005 · WEB
oracle.com/security-alerts/cpuapr2022.html · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
openwall.com/lists/oss-security/2022/01/24/3 · WEB
security.netapp.com/advisory/ntap-20221028-0005 · Third Party Advisory

Weitere Schwachstellen in xerces:xercesImpl

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free