GHSA-99wh-973f-779p

XML External Entity Reference in Hazelcast

At a glance

Published: 2022-03-04
Updated: 2024-02-19
CVE: CVE-2022-0265
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

Affected packages

Package	Versions
Maven · com.hazelcast:hazelcast	introduced 5.1-beta1, fixed 5.1

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0265 ADVISORY
https://github.com/hazelcast/hazelcast/pull/20407 WEB
https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748 WEB
https://github.com/hazelcast/hazelcast WEB
https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database