| Package | Affected versions | Patched versions |
|---|---|---|
| org.jboss.ws:jbossws-common | < 2.1.0.Final | 2.1.0.Final |
| network node manager i | = 9.0= 9.01= 9.02= 9.03= 9.10 | |
| jboss communications platform | = 1.2.11= 5.1.1 | |
| jboss enterprise application platform | = 4.2.0= 4.3.0= 5.1.1 | |
| jboss enterprise brms platform | = 5.1.0 | |
| jboss enterprise portal platform | = 4.3.0= 5.1.1 | |
| jboss enterprise soa platform | = 4.2.0= 4.3.0= 5.1.0 | |
| jboss enterprise web platform | = 5.1.1 |
DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free