REDHAT-BUG-1451960: SSRF
First published: Thu May 18 2017(Updated: )
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1451961
- http://hg.openjdk.java.net/jdk8/jdk8/jaxp/
- https://issues.jboss.org/browse/WFCORE-2805?focusedCommentId=13447139&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13447139
- https://access.redhat.com/errata/RHSA-2020:2563
- https://access.redhat.com/security/cve/cve-2017-7503
- https://bugzilla.redhat.com/show_bug.cgi?id=1451960
Frequently Asked Questions
What is the severity of REDHAT-BUG-1451960?
The severity of REDHAT-BUG-1451960 is considered critical due to its potential for DoS and SSRF attacks.
How do I fix REDHAT-BUG-1451960?
To fix REDHAT-BUG-1451960, upgrade your Red Hat JBoss EAP to the latest patched version that addresses this vulnerability.
What types of attacks can REDHAT-BUG-1451960 be exploited for?
REDHAT-BUG-1451960 can be exploited for denial of service (DoS), server-side request forgery (SSRF), and unauthorized file reading.
Which versions of Red Hat JBoss EAP are affected by REDHAT-BUG-1451960?
REDHAT-BUG-1451960 affects Red Hat JBoss EAP 7.0.5 and possibly other versions prior to the fix.
Is there any workaround for REDHAT-BUG-1451960?
There is no reliable workaround for REDHAT-BUG-1451960; upgrading to a secure version is recommended.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-7503
- agent/trending
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat jboss enterprise application platform