REDHAT-BUG-1357015: Medium severity OpenJDK JAXP vulnerability
It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.
Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1357015?
The severity of REDHAT-BUG-1357015 is high due to the potential for memory and CPU exhaustion in Java applications.
How do I fix REDHAT-BUG-1357015?
To fix REDHAT-BUG-1357015, update to the latest version of OpenJDK that addresses this vulnerability.
What are the potential impacts of REDHAT-BUG-1357015?
The potential impacts of REDHAT-BUG-1357015 include degraded performance and application crashes due to excessive resource consumption.
Who is affected by REDHAT-BUG-1357015?
Anyone using the JAXP component of OpenJDK versions prone to this bug may be affected by REDHAT-BUG-1357015.
Is there a workaround for REDHAT-BUG-1357015?
There are no official workarounds for REDHAT-BUG-1357015 besides applying the recommended updates to mitigate the vulnerability.