https://bugzilla.redhat.com/show_bug.cgi?id=1520471
Bug ID: 1520471
Summary: CVE-2017-14949 restlet: XXE vulnerability in XML
extension allows remote attackers to access arbitrary
files via a crafted REST API HTTP request
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary
files via a crafted REST API HTTP request that conducts an XXE attack, because
only general external entities (not parameter external entities) are properly
considered. This is related to XmlRepresentation, DOMRepresentation,
SaxRepresentation, and JacksonRepresentation.
External References:
https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhan...
--
You are receiving this mail because:
You are on the CC list for the bug.