Bugzilla – Bug 870082
VUL-0: CVE-2014-0107: xalan-j2: [oCERT-2014-002] Xalan-Java insufficient secure processing
Last modified: 2014-07-30 18:46:56 UTC
via oss-sec, ocert #2014-002 Xalan-Java insufficient secure processing Description: The Xalan-Java library is a popular XSLT processor from the Apache Software Foundation. The library implements the Java API for XML Processing (JAXP) which supports a secure processing feature for interpretive and XSLCT processors. The intent of this feature is to limit XSLT/XML processing behaviours to "make the XSLT processor behave in a secure fashion". It has been discovered that the secure processing features suffers from several limitations that undermine its purpose. The enabling of the secure processing feature in fact still allows the following processing to take place: * Java properties, bound to XSLT 1.0 system-property(), are accessible. * output properties that allow to load arbitrary classes or resources are allowed (XALANJ-2435). * arbitrary code can be executed if the Bean Scripting Framework (BSF) is in the classpath, as it allows to spawn available JARs with secure processing disabled, effectively bypassing the intended protection. Affected version: Xalan-Java >= 2.7.0 Fixed version: Xalan-Java >= r1581058 (see references) Credit: vulnerability report received from Nicolas Gregoire <nicolas.gregoire AT agarri.fr>. CVE: CVE-2014-0107 Timeline: 2014-02-05: vulnerability report received 2014-02-05: reporter provides disclosure date set to 2014-03-21 2014-02-06: contacted Apache Security Team 2014-03-17: maintainer provides patch for review 2014-03-17: reporter confirms patch 2014-03-21: assigned CVE 2014-03-24: maintainer commits patch 2014-03-24: advisory release References: http://xml.apache.org/xalan-j https://issues.apache.org/jira/browse/XALANJ-2435 http://svn.apache.org/viewvc?view=revision&revision=1581058 Permalink: http://www.ocert.org/advisories/ocert-2014-002.html References: https://bugzilla.redhat.com/show_bug.cgi?id=1080248 http://comments.gmane.org/gmane.comp.security.oss.general/12434 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0107 http://www.ocert.org/advisories/ocert-2014-002.html
bugbot adjusting priority
Tom, can you one of your guys look at this please. Thanks.
This is an autogenerated message for OBS integration: This bug (870082) was mentioned in https://build.opensuse.org/request/show/238326 Factory / xalan-j2
Submitted to: openSUSE: 12.3 13.1 Factory SLE: 12 11 SLE10: not affected from what I understand, let me know if it is needed too tho.
Affected packages: SLE-11-SP3: xalan-j2
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2014-06-30. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/57996
This is an autogenerated message for OBS integration: This bug (870082) was mentioned in https://build.opensuse.org/request/show/238329 13.1+12.3 / xalan-j2
openSUSE-SU-2014:0861-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 870082 CVE References: CVE-2014-0107 Sources used: openSUSE 13.1 (src): xalan-j2-2.7.0-262.4.1 openSUSE 12.3 (src): xalan-j2-2.7.0-259.4.1
Update released for: xalan-j2, xalan-j2-demo, xalan-j2-javadoc, xalan-j2-manual, xalan-j2-xsltc Products: SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP3 (i386, x86_64)
Update released for: xalan-j2, xalan-j2-demo, xalan-j2-javadoc, xalan-j2-manual, xalan-j2-xsltc Products: SLE-SERVER 11-SP1-TERADATA (x86_64)
SUSE-SU-2014:0870-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 870082 CVE References: CVE-2014-0107 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): xalan-j2-2.7.0-217.26.1 SUSE Linux Enterprise Server 11 SP3 for VMware (src): xalan-j2-2.7.0-217.26.1 SUSE Linux Enterprise Server 11 SP3 (src): xalan-j2-2.7.0-217.26.1 SUSE Linux Enterprise Desktop 11 SP3 (src): xalan-j2-2.7.0-217.26.1
fixed
openSUSE-SU-2014:0948-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 870082 CVE References: CVE-2014-0107 Sources used: openSUSE 11.4 (src): xalan-j2-2.7.0-253.1