XML External Entity Reference in apache jena

CRÍTICO 9.8CVE-2022-28890 · GHSA-gchv-364h-r896 · Published 05/05/2022 · updated 17/06/2026

Em resumo

CVE-2022-28890 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta org.apache.jena:jena, jena (apache).
Chance de exploração nos próximos 30 dias (EPSS): 2.7%, maior que 85.8% das vulnerabilidades.
Correção: atualize para 4.5.0 ou posterior.

Package	Affected versions	Patched versions
org.apache.jena:jena Maven	`≥ 4.4.0, < 4.5.0`	`4.5.0`
jena apache	`= 4.4.0`	No fix yet

Description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 only. Apache Jena 4.2.x and 4.3.x do not allow external entities.

NVD description

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

References

nvd.nist.gov/vuln/detail/CVE-2022-28890 · ADVISORY
gitbox.apache.org/repos/asf/jena.git · PACKAGE
jena.apache.org/about_jena/security-advisories.html · WEB
lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878 · WEB

Mais vulnerabilidades de org.apache.jena:jena

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.jena:jena

Maven

≥ 4.4.0, < 4.5.0

4.5.0

jena

apache

= 4.4.0

No fix yet

Description

NVD description

Mais vulnerabilidades de org.apache.jena:jena

Ver tudo →