UBUNTU-CVE-2017-18197: Critical severity ubuntu/libjgraphx-java vulnerability

Q: Which releases should be considered affected?

mxGraph releases before 3.7.6 are affected. The affected Ubuntu software package is libjgraphx-java; the provided data does not identify specific Ubuntu package versions.

Q: What access does an attacker need to exploit this issue?

The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: Which application functionality should be reviewed for exposure?

Review uses of mxGraphViewImageReader.java, specifically its convert() method. The issue is demonstrated through /ServerView, so deployments exposing that functionality warrant particular attention.

Published Feb 24, 2018

Updated

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

Affected Software

2 affected componentsFixes available

ubuntu/libjgraphx-java<2.1.0.7-1ubuntu0.16.04.1~esm1

2.1.0.7-1ubuntu0.16.04.1~esm1

ubuntu/libjgraphx-java<2.1.0.7-1ubuntu0.18.04.1~esm1

2.1.0.7-1ubuntu0.18.04.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libjgraphx-java to a version that resolves this vulnerability.
Fixed in 2.1.0.7-1ubuntu0.16.04.1~esm1
Upgrade
Upgrade ubuntu/libjgraphx-java to a version that resolves this vulnerability.
Fixed in 2.1.0.7-1ubuntu0.18.04.1~esm1

Event History

Feb 24, 2018

CVE Published

via OSV·02:29 AM

Data Sourced

via OSV·02:29 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which releases should be considered affected?

mxGraph releases before 3.7.6 are affected. The affected Ubuntu software package is libjgraphx-java; the provided data does not identify specific Ubuntu package versions.

What access does an attacker need to exploit this issue?

The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Which application functionality should be reviewed for exposure?

Review uses of mxGraphViewImageReader.java, specifically its convert() method. The issue is demonstrated through /ServerView, so deployments exposing that functionality warrant particular attention.

UBUNTU-CVE-2017-18197: Critical severity ubuntu/libjgraphx-java vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which releases should be considered affected?

What access does an attacker need to exploit this issue?

Which application functionality should be reviewed for exposure?

Company

Resources

Contact

Frequently Asked Questions

Which releases should be considered affected?

What access does an attacker need to exploit this issue?

Which application functionality should be reviewed for exposure?