Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-4221 · ADVISORY
• restlet/restlet-framework-java · WEB
• restlet/restlet-framework-java commit b85c2ef · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• restlet/restlet-framework-java · PACKAGE
• blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html · WEB
• restlet.org/learn/2.1/changes · WEB
• rhn.redhat.com/errata/RHSA-2013-1410.html · WEB
• rhn.redhat.com/errata/RHSA-2013-1862.html · WEB

org.restlet.jse:org.restlet のその他の脆弱性

• CVE-2017-14949高 7.5Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE a…
• CVE-2014-1868中 5.0Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a …
• CVE-2013-4271高 7.5The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allow…