https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Bug ID: 1801149 Summary: CVE-2019-13990 libquartz-java: XXE attacks via job description Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: darunesh@redhat.com CC: agrimm@gmail.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, bbuckingham@redhat.com, bcourt@redhat.com, bkearney@redhat.com, btotty@redhat.com, chazlett@redhat.com, dblechte@redhat.com, dfediuck@redhat.com, drieden@redhat.com, eedri@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, gvarsami@redhat.com, hhudgeon@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jochrist@redhat.com, jstastny@redhat.com, jwon@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, ldimaggi@redhat.com, lef@fedoraproject.org, lzap@redhat.com, mgoldboi@redhat.com, michal.skrivanek@redhat.com, mmccune@redhat.com, mnovotny@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pjindal@redhat.com, puntogil@libero.it, rchan@redhat.com, rjerrido@redhat.com, rrajasek@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sbonazzo@redhat.com, sdaley@redhat.com, sherold@redhat.com, sokeeffe@redhat.com, tbrisker@redhat.com, tcunning@redhat.com, tkirby@redhat.com, tlestach@redhat.com, yturgema@redhat.com Target Milestone: --- Classification: Other
A vulnerability was found in initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Reference: https://github.com/quartz-scheduler/quartz/issues/467 https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91... https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d... https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4... https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83... https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900...
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Dhananjay Arunesh darunesh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1801151 Summary|CVE-2019-13990 |CVE-2019-13990 libquartz: |libquartz-java: XXE attacks |XXE attacks via job |via job description |description
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Jonathan Christison jochrist@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |quartz-2.3.2
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1807886
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1814511, 1814510
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1814510 [Bug 1814510] CVE-2019-13990 quartz: libquartz: XXE attacks via job description [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #6 from Doran Moppert dmoppert@redhat.com --- Created quartz tracking bugs for this issue:
Affects: fedora-all [bug 1814510]
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Barnaby Court bcourt@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2020-03-23 14:37:23
--- Comment #8 from Barnaby Court bcourt@redhat.com --- We quartz as an embedded library and do not use the relevant XML based job creation that is affected by this CVE.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Barnaby Court bcourt@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|NOTABUG |WONTFIX
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Cedric Buissart 🐶 cbuissar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|WONTFIX |--- Keywords| |Reopened
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #9 from Cedric Buissart 🐶 cbuissar@redhat.com --- Statement:
Red Hat Satellite 6 uses a vulnerable version of libquartz as a dependency for candlepin. However, the <job><descrition> entry is not used, and the vulnerability can not be triggered. An update may fix the code in the future.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Ted (Jong Seok) Won jwon@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Rolfe Dlugy-Hegwer rdlugyhe@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |rdlugyhe@redhat.com, | |security-response-team@redh | |at.com Flags| |needinfo?(security-response | |-team@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Yogendra Jog yjog@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dmoppert@redhat.com Flags|needinfo?(security-response |needinfo?(dmoppert@redhat.c |-team@redhat.com) |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in quartz through version 2.3.0. A XXE attack is possible in the Terracotta Quartz Scheduler using a job description. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3196
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3197
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed|2020-03-23 14:37:23 |2020-07-29 07:27:42
--- Comment #16 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2019-13990
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Virtualization Engine 4.4
Via RHSA-2020:3247 https://access.redhat.com/errata/RHSA-2020:3247
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:3247
https://bugzilla.redhat.com/show_bug.cgi?id=1801149 Bug 1801149 depends on bug 1814510, which changed state.
Bug 1814510 Summary: CVE-2019-13990 quartz: libquartz: XXE attacks via job description [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1814510
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.8.0
Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2020:5568
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI trathi@redhat.com --- A flaw was found in quartz through version 2.3.0. A XXE attack is possible in the Terracotta Quartz Scheduler using a job description. The highest threat from this vulnerability is to data confidentiality, integrity as well as system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in Quartz through version 2.3.0. An XML external entity attack (XXE) is possible in the Terracotta Quartz Scheduler using a job description, affecting data confidentiality, integrity, and system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI trathi@redhat.com --- A flaw was found in Quartz. An XML external entity attack (XXE) is possible in the Terracotta Quartz Scheduler using a job description, affecting data confidentiality, integrity, and system availability.
https://bugzilla.redhat.com/show_bug.cgi?id=1801149
--- Doc Text *updated* by TEJ RATHI trathi@redhat.com --- The Terracotta Quartz Scheduler is susceptible to an XML external entity attack (XXE) through a job description. This issue stems from inadequate handling of XML external entity (XXE) declarations in the initDocumentParser function within xml/XMLSchedulingDataProcessor.java. By enticing a victim to access a maliciously crafted job description (containing XML content), a remote attacker could exploit this vulnerability to execute an XXE attack on the targeted system.
java-sig-commits@lists.fedoraproject.org