REDHAT-BUG-1273645: Medium severity openjdk 8 vulnerability

Published Oct 20, 2015

Updated

It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Oct 20, 2015

Data Sourced

08:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Java applications using the JAXP StAX XML parser are exposed when they parse attacker-controlled or otherwise untrusted XML documents. The impact is excessive memory and CPU consumption during parsing.

Does disabling DTD support with javax.xml.stream.supportDTD prevent exploitation?

No. The issue is that certain DTD processing can still occur even when DTD support is disabled through the javax.xml.stream.supportDTD system property.

What must an attacker provide to trigger the issue?

An attacker needs to supply a specially crafted XML document that is parsed by the affected JAXP StAX XML parser. Successful triggering results in resource consumption that can degrade application availability.

REDHAT-BUG-1273645: Medium severity openjdk 8 vulnerability

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

Does disabling DTD support with javax.xml.stream.supportDTD prevent exploitation?

What must an attacker provide to trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

Does disabling DTD support with javax.xml.stream.supportDTD prevent exploitation?

What must an attacker provide to trigger the issue?