JBossWS vulnerable to uncontrolled recursion

中 5.0CVE-2011-1483 · GHSA-rj4p-7mm6-gm9j · 29/07/2013 公開 · 16/06/2026 更新

要点

CVE-2011-1483 は org.jboss.ws:jbossws-common, network node manager i (hp), jboss communications platform (redhat) に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.7%（全脆弱性の 85.7% より高い）。
対処：2.1.0.Final 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jboss.ws:jbossws-common Maven	`< 2.1.0.Final`	`2.1.0.Final`
network node manager i hp	`= 9.0= 9.01= 9.02= 9.03= 9.10`	修正版なし
jboss communications platform redhat	`= 1.2.11= 5.1.1`	修正版なし
jboss enterprise application platform redhat	`= 4.2.0= 4.3.0= 5.1.1`	修正版なし
jboss enterprise brms platform redhat	`= 5.1.0`	修正版なし
jboss enterprise portal platform redhat	`= 4.3.0= 5.1.1`	修正版なし
jboss enterprise soa platform redhat	`= 4.2.0= 4.3.0= 5.1.0`	修正版なし
jboss enterprise web platform redhat	`= 5.1.1`	修正版なし

概要

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.

NVD の説明

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.