CVE-2014-0423: Medium severity ORACLE Jrockit vulnerability
It was discovered that the decoder (DocumentHandler in OpenJDK 7 and ObjectHandler OpenJDK 6) allowed processing of XML external entities. An application using JavaBeans could possibly disclose sensitive information, or be target of a DoS attack, triggered via XML external entities.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote authenticated users to affect confidentiality and availability via unknown vectors related to Beans. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability in DocumentHandler.java, related to Beans decoding.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 2.3.13 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.12.8 - Upgrade
Upgrade
redhat/icedteato a version that resolves this vulnerability.Fixed in 1.13.1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0423?
CVE-2014-0423 is classified as a medium-severity vulnerability that can lead to information disclosure or Denial of Service attacks.
How do I fix CVE-2014-0423?
To address CVE-2014-0423, upgrade to a non-vulnerable version of the affected packages, such as icedtea 2.4.4 or JDK 1.7.0-update45.
What applications are affected by CVE-2014-0423?
CVE-2014-0423 affects applications utilizing JavaBeans that process XML external entities, specifically in OpenJDK and Oracle JDK versions.
What types of attacks can be executed due to CVE-2014-0423?
CVE-2014-0423 can enable attackers to perform information disclosure and Denial of Service (DoS) attacks via malicious XML content.
Is there any workaround for CVE-2014-0423 if I cannot update immediately?
A recommended temporary workaround for CVE-2014-0423 is to disable the processing of XML external entities in your application configuration until a patch can be applied.