CVE-2011-1483: Medium severity jboss enterprise application platform vulnerability
wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1483?
CVE-2011-1483 is classified as a medium severity vulnerability.
How do I fix CVE-2011-1483?
To fix CVE-2011-1483, upgrade to the latest versions of the affected JBoss software platforms as recommended by Red Hat.
Which software versions are affected by CVE-2011-1483?
CVE-2011-1483 affects specific versions of JBoss Enterprise Application Platform, JBoss Portal, JBoss SOA Platform, and other JBoss products.
What impact does CVE-2011-1483 have on affected systems?
CVE-2011-1483 can lead to potential denial of service on systems running the vulnerable JBoss products.
Is there a workaround for CVE-2011-1483?
While upgrading is the best option, specific configuration changes may reduce exposure to CVE-2011-1483, but are not a complete solution.