CVE-2018-12544: XEE
An XML External Entity vulnerability was found in vertx-web before 3.5.4. The function isValid didn't provide any XXE protection when parsing an XML document.
Upstream issue:
https://github.com/vert-x3/vertx-web/issues/1021
References:
https://bugs.eclipse.org/bugs/showbug.cgi?id=539568
Upstream patches:
https://github.com/vert-x3/vertx-web/pull/1022/commits/d814d22ade14bafec47c4447a4ba9bff090f05e8 https://github.com/vert-x3/vertx-web/pull/1022/commits/26db16c7b32e655b489d1a71605f9a785f788e41
Other sources
In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12544?
CVE-2018-12544 has been classified as a medium severity vulnerability.
How do I fix CVE-2018-12544?
To fix CVE-2018-12544, upgrade to Eclipse Vert.x version 3.5.4 or later.
What versions of Eclipse Vert.x are affected by CVE-2018-12544?
CVE-2018-12544 affects Eclipse Vert.x versions 3.5.0 through 3.5.3, including beta versions and release candidates.
What type of vulnerability is CVE-2018-12544?
CVE-2018-12544 is an XML parsing vulnerability that can lead to XML attacks.
In which component does CVE-2018-12544 exist?
CVE-2018-12544 exists in the OpenAPI XML type validator within Eclipse Vert.x.