Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1378673 (CVE-2016-7051) - CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack
Summary: CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-7051
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1380205 1380206
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-23 03:47 UTC by Jason Shepherd
Modified: 2021-10-21 00:55 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-10-21 00:55:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Jason Shepherd 2016-09-23 03:47:22 UTC 
A flaw was found in jackson-dataformat-xml's XmlMapper which allows XXE Out of Band attack. An attacker could use this flaw to launch a SSRF attack.
Comment 1 Jason Shepherd 2016-09-23 03:47:27 UTC 
Acknowledgments:

Name: Adith Sudhakar
Comment 3 Jason Shepherd 2016-09-28 23:31:42 UTC 
Created jberet tracking bugs for this issue:

Affects: fedora-all [bug 1380205]
Comment 4 Jason Shepherd 2016-09-28 23:31:47 UTC 
Created jackson-dataformat-xml tracking bugs for this issue:

Affects: fedora-all [bug 1380206]
Comment 5 Salvatore Bonaccorso 2016-12-20 17:10:51 UTC 
Hi

Is this a duplicate of CVE-2016-3720?

Regards,
Salvatore
Comment 6 Kurt Seifried 2016-12-25 19:21:57 UTC 
(In reply to Salvatore Bonaccorso from comment #5)
> Hi
> 
> Is this a duplicate of CVE-2016-3720?
> 
> Regards,
> Salvatore

Good questions. Resetting NEEDINFO to amaris, he assigned CVE-2016-7051 in response to jsheppard, I've looked at the bugs but it's a bit convoluted. I've also emailed them to ensure they see this.
Comment 7 Jason Shepherd 2017-01-03 00:57:23 UTC 
These 2 issues are distinct. The first issues was about XXE, and was fixed with the change in line 115 here:

https://github.com/FasterXML/jackson-dataformat-xml/blob/master/src/main/java/com/fasterxml/jackson/dataformat/xml/XmlFactory.java

The second issue was about DTD, and was fixed with the change in line 117.
Comment 8 Salvatore Bonaccorso 2017-01-05 20:50:02 UTC 
Thanks for the clarification.
Note You need to log in before you can comment on or make changes to this bug.