REDHAT-BUG-1273638: Medium severity OpenJDK JAXP vulnerability

Published Oct 20, 2015

Updated

It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.

Affected Software

1 affected component

OpenJDK JAXP

Event History

Oct 20, 2015

Data Sourced

via Red Hat·08:38 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1273638?

The severity of REDHAT-BUG-1273638 is considered high due to its potential impact on system resources.

How do I fix REDHAT-BUG-1273638?

To fix REDHAT-BUG-1273638, upgrade to the patched version of OpenJDK that corrects the XML name limit enforcement.

What vulnerability does REDHAT-BUG-1273638 exploit?

REDHAT-BUG-1273638 exploits the lack of enforcement of the maximum XML name limit in the JAXP component of OpenJDK.

Which versions of OpenJDK are affected by REDHAT-BUG-1273638?

REDHAT-BUG-1273638 affects specific versions of OpenJDK JAXP prior to the security update that enforces the XML name limit.

What are the potential consequences of REDHAT-BUG-1273638?

The potential consequences of REDHAT-BUG-1273638 include excessive memory consumption and CPU time leading to application performance degradation.