You are viewing a plain text version of this content. The canonical link for it is here.
Posted to j-dev@xerces.apache.org by David Dillard <Da...@veritas.com> on 2018/04/19 18:16:04 UTC
CVE-2018-2799
Hi,
Tuesday, Oracle released its Quarterly Critical Patch Update, which included some fixes for Java<http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA>. I saw that one of those fixes was for JAXP (CVE-2018-2799). Going to Red Hat's CVE database to get a real description<https://bugzilla.redhat.com/show_bug.cgi?id=1567542> of the issue it says "It was discovered that the implementation of the NamedNodeMapImpl class in the JAXP component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized." It also includes the OpenJDK issue #. Looking for that change in the OpenJDK repository<http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/5279c6da822e> it shows a small change in readObject that is not found in the current Apache Xerces code.
Current Xerces code<https://github.com/apache/xerces2-j/blob/trunk/src/org/apache/xerces/dom/NamedNodeMapImpl.java#L604>:
private void readObject(ObjectInputStream in)
throws IOException, ClassNotFoundException {
in.defaultReadObject();
if (nodes != null) {
nodes = new ArrayList(nodes);
}
}
Current OpenJDK code<http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/file/5279c6da822e/src/com/sun/org/apache/xerces/internal/dom/NamedNodeMapImpl.java#l606>:
private void readObject(ObjectInputStream in)
throws IOException, ClassNotFoundException {
in.defaultReadObject();
if (nodes != null) {
// cast to Vector is required
nodes = new ArrayList((Vector)nodes);
}
}
Should this modification be made to Xerces? Do people agree that it's a vulnerability?
Thanks,
David
Re: CVE-2018-2799
Posted by Mukul Gandhi <mu...@apache.org>.
Hi Michael,
Thanks for these details and explanation. It had been a long time, I
worked on java object serialization. I can now recall the concepts.
I've committed the fix (mirroring the fix which David mentioned), to the
trunk and schema1.1-dev branch.
On Fri, Apr 20, 2018 at 6:12 PM, Michael Glavassevich <mr...@ca.ibm.com>
wrote:
> Hi Mukul,
>
> I would suggest reviewing the documentation for java.io.Serializable [1]
> for details about readObject()/writeObject(). This code gets called by Java
> when a user reads or writes a DOM using Java object serialization.
>
> The conversions between ArrayList and Vector in NamedNodeMapImpl are there
> for compatibility reasons. Casting to Vector when creating the ArrayList in
> readObject() prevents other unexpected List types from being injected into
> the stream.
>
> Thanks.
>
> [1] https://docs.oracle.com/javase/8/docs/api/java/io/Serializable.html
>
> Michael Glavassevich
> XML Technologies and WAS Development
> IBM Toronto Lab
> E-mail: mrglavas@ca.ibm.com
> E-mail: mrglavas@apache.org
--
Regards,
Mukul Gandhi
Re: CVE-2018-2799
Posted by Michael Glavassevich <mr...@ca.ibm.com>.
Hi Mukul,
I would suggest reviewing the documentation for java.io.Serializable [1]
for details about readObject()/writeObject(). This code gets called by
Java when a user reads or writes a DOM using Java object serialization.
The conversions between ArrayList and Vector in NamedNodeMapImpl are there
for compatibility reasons. Casting to Vector when creating the ArrayList
in readObject() prevents other unexpected List types from being injected
into the stream.
Thanks.
[1] https://docs.oracle.com/javase/8/docs/api/java/io/Serializable.html
Michael Glavassevich
XML Technologies and WAS Development
IBM Toronto Lab
E-mail: mrglavas@ca.ibm.com
E-mail: mrglavas@apache.org
Mukul Gandhi <mu...@apache.org> wrote on 04/20/2018 12:01:15 AM:
> Hi David,
> The "private void readObject(...)" method you've cited is not
> called from anywhere. i.e its a unused method/redundant code.
>
> Please correct me if I'm wrong.
>
> On Thu, Apr 19, 2018 at 11:46 PM, David Dillard
<David.Dillard@veritas.com
> > wrote:
> Hi,
>
> Tuesday, Oracle released its Quarterly Critical Patch Update, which
included
> some fixes for Java. I saw that one of those fixes was for JAXP
> (CVE-2018-2799). Going to Red Hat’s CVE database to get a real
description
> of the issue it says “It was discovered that the implementation of
> the NamedNodeMapImpl class in the JAXP component of OpenJDK did not
> limit the amount of memory allocated when creating object instance
> from a serialized form. A specially-crafted input could cause a
> Java application to use an excessive amount of memory when
> deserialized.” It also includes the OpenJDK issue #. Looking for
> that change in the OpenJDK repository it shows a small change in
> readObject that is not found in the current Apache Xerces code.
>
> Current Xerces code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> nodes = new ArrayList(nodes);
> }
> }
>
>
> Current OpenJDK code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> // cast to Vector is required
> nodes = new ArrayList((Vector)nodes);
> }
> }
>
>
> Should this modification be made to Xerces? Do people agree that
> it’s a vulnerability?
>
>
> --
> Regards,
> Mukul Gandhi
Re: CVE-2018-2799
Posted by Mukul Gandhi <mu...@apache.org>.
Hi David,
The "private void readObject(...)" method you've cited is not called
from anywhere. i.e its a unused method/redundant code.
Please correct me if I'm wrong.
On Thu, Apr 19, 2018 at 11:46 PM, David Dillard <Da...@veritas.com>
wrote:
> Hi,
>
>
>
> Tuesday, Oracle released its Quarterly Critical Patch Update, which
> included some fixes for Java
> <http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA>.
> I saw that one of those fixes was for JAXP (CVE-2018-2799). Going to Red
> Hat’s CVE database to get a real description
> <https://bugzilla.redhat.com/show_bug.cgi?id=1567542> of the issue it
> says “It was discovered that the implementation of the NamedNodeMapImpl
> class in the JAXP component of OpenJDK did not limit the amount of memory
> allocated when creating object instance from a serialized form. A
> specially-crafted input could cause a Java application to use an excessive
> amount of memory when deserialized.” It also includes the OpenJDK issue
> #. Looking for that change in the OpenJDK repository
> <http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/5279c6da822e> it shows a
> small change in readObject that is not found in the current Apache Xerces
> code.
>
>
>
> Current Xerces code
> <https://github.com/apache/xerces2-j/blob/trunk/src/org/apache/xerces/dom/NamedNodeMapImpl.java#L604>
> :
>
>
>
> private void readObject(ObjectInputStream in)
>
> throws IOException, ClassNotFoundException {
>
> in.defaultReadObject();
>
> if (nodes != null) {
>
> nodes = new ArrayList(nodes);
>
> }
>
> }
>
>
>
>
>
> Current OpenJDK code
> <http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/file/5279c6da822e/src/com/sun/org/apache/xerces/internal/dom/NamedNodeMapImpl.java#l606>
> :
>
>
>
> private void readObject(ObjectInputStream in)
>
> throws IOException, ClassNotFoundException {
>
> in.defaultReadObject();
>
> if (nodes != null) {
>
> // cast to Vector is required
>
> nodes = new ArrayList((Vector)nodes);
>
> }
>
> }
>
>
>
>
>
> Should this modification be made to Xerces? Do people agree that it’s a
> vulnerability?
>
--
Regards,
Mukul Gandhi
RE: [EXTERNAL] Re: CVE-2018-2799
Posted by David Dillard <Da...@veritas.com>.
I previously sent a similar issue to the Apache security team and they said since the issue had been publicly disclosed that I should just take it directly to the project, that’s why I did so in this case.
From: Michael Glavassevich [mailto:mrglavas@ca.ibm.com]
Sent: Thursday, April 19, 2018 4:21 PM
To: j-dev@xerces.apache.org
Subject: RE: [EXTERNAL] Re: CVE-2018-2799
This discussion should have probably started on security@ [1]. In future I would suggest reporting there before bringing it to one of the public lists.
I can confirm that the patch you've found treats the symptom of another problem but won't disclose details of what that problem is here. It's not specific to Xerces. I do agree that we should patch this.
Thanks.
[1] https://www.apache.org/security/
Michael Glavassevich
XML Technologies and WAS Development
IBM Toronto Lab
E-mail: mrglavas@ca.ibm.com<ma...@ca.ibm.com>
E-mail: mrglavas@apache.org<ma...@apache.org>
David Dillard <Da...@veritas.com>> wrote on 04/19/2018 02:36:54 PM:
> That’s the only change in the changeset and the last time that file
> was updated in OpenJDK was 2012, so I think that’s it. I know it’s
> very little, that’s why I asked if people agree it’s a vulnerability
> – it doesn’t feel like the kind of issue described, but I don’t
> think Oracle would have published a CVE for it if they didn’t think it was.
>
>
> From: Gary Gregory [mailto:garydgregory@gmail.com]
> Sent: Thursday, April 19, 2018 2:24 PM
> To: j-dev@xerces.apache.org<ma...@xerces.apache.org>
> Subject: [EXTERNAL] Re: CVE-2018-2799
>
> So the idea is that the code blows up if nodes is _not_ a Vector.
> But, a Vector is not bound either. Is there more to the fix than that?
>
> Gary
>
> On Thu, Apr 19, 2018 at 12:16 PM, David Dillard <David.Dillard@veritas.com
<mailto:David.Dillard@veritas.com%0b>> > wrote:
> Hi,
>
> Tuesday, Oracle released its Quarterly Critical Patch Update, which included
> some fixes for Java. I saw that one of those fixes was for JAXP
> (CVE-2018-2799). Going to Red Hat’s CVE database to get a real description
> of the issue it says “It was discovered that the implementation of
> the NamedNodeMapImpl class in the JAXP component of OpenJDK did not
> limit the amount of memory allocated when creating object instance
> from a serialized form. A specially-crafted input could cause a
> Java application to use an excessive amount of memory when
> deserialized.” It also includes the OpenJDK issue #. Looking for
> that change in the OpenJDK repository it shows a small change in
> readObject that is not found in the current Apache Xerces code.
>
> Current Xerces code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> nodes = new ArrayList(nodes);
> }
> }
>
>
> Current OpenJDK code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> // cast to Vector is required
> nodes = new ArrayList((Vector)nodes);
> }
> }
>
>
> Should this modification be made to Xerces? Do people agree that
> it’s a vulnerability?
>
> Thanks,
>
> David
RE: [EXTERNAL] Re: CVE-2018-2799
Posted by Michael Glavassevich <mr...@ca.ibm.com>.
This discussion should have probably started on security@ [1]. In future I
would suggest reporting there before bringing it to one of the public
lists.
I can confirm that the patch you've found treats the symptom of another
problem but won't disclose details of what that problem is here. It's not
specific to Xerces. I do agree that we should patch this.
Thanks.
[1] https://www.apache.org/security/
Michael Glavassevich
XML Technologies and WAS Development
IBM Toronto Lab
E-mail: mrglavas@ca.ibm.com
E-mail: mrglavas@apache.org
David Dillard <Da...@veritas.com> wrote on 04/19/2018 02:36:54 PM:
> That’s the only change in the changeset and the last time that file
> was updated in OpenJDK was 2012, so I think that’s it. I know it’s
> very little, that’s why I asked if people agree it’s a vulnerability
> – it doesn’t feel like the kind of issue described, but I don’t
> think Oracle would have published a CVE for it if they didn’t think it
was.
>
>
> From: Gary Gregory [mailto:garydgregory@gmail.com]
> Sent: Thursday, April 19, 2018 2:24 PM
> To: j-dev@xerces.apache.org
> Subject: [EXTERNAL] Re: CVE-2018-2799
>
> So the idea is that the code blows up if nodes is _not_ a Vector.
> But, a Vector is not bound either. Is there more to the fix than that?
>
> Gary
>
> On Thu, Apr 19, 2018 at 12:16 PM, David Dillard
<David.Dillard@veritas.com
> > wrote:
> Hi,
>
> Tuesday, Oracle released its Quarterly Critical Patch Update, which
included
> some fixes for Java. I saw that one of those fixes was for JAXP
> (CVE-2018-2799). Going to Red Hat’s CVE database to get a real
description
> of the issue it says “It was discovered that the implementation of
> the NamedNodeMapImpl class in the JAXP component of OpenJDK did not
> limit the amount of memory allocated when creating object instance
> from a serialized form. A specially-crafted input could cause a
> Java application to use an excessive amount of memory when
> deserialized.” It also includes the OpenJDK issue #. Looking for
> that change in the OpenJDK repository it shows a small change in
> readObject that is not found in the current Apache Xerces code.
>
> Current Xerces code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> nodes = new ArrayList(nodes);
> }
> }
>
>
> Current OpenJDK code:
>
> private void readObject(ObjectInputStream in)
> throws IOException, ClassNotFoundException {
> in.defaultReadObject();
> if (nodes != null) {
> // cast to Vector is required
> nodes = new ArrayList((Vector)nodes);
> }
> }
>
>
> Should this modification be made to Xerces? Do people agree that
> it’s a vulnerability?
>
> Thanks,
>
> David
RE: [EXTERNAL] Re: CVE-2018-2799
Posted by David Dillard <Da...@veritas.com>.
That’s the only change in the changeset and the last time that file was updated in OpenJDK was 2012, so I think that’s it. I know it’s very little, that’s why I asked if people agree it’s a vulnerability – it doesn’t feel like the kind of issue described, but I don’t think Oracle would have published a CVE for it if they didn’t think it was.
From: Gary Gregory [mailto:garydgregory@gmail.com]
Sent: Thursday, April 19, 2018 2:24 PM
To: j-dev@xerces.apache.org
Subject: [EXTERNAL] Re: CVE-2018-2799
So the idea is that the code blows up if nodes is _not_ a Vector. But, a Vector is not bound either. Is there more to the fix than that?
Gary
On Thu, Apr 19, 2018 at 12:16 PM, David Dillard <Da...@veritas.com>> wrote:
Hi,
Tuesday, Oracle released its Quarterly Critical Patch Update, which included some fixes for Java<http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA>. I saw that one of those fixes was for JAXP (CVE-2018-2799). Going to Red Hat’s CVE database to get a real description<https://bugzilla.redhat.com/show_bug.cgi?id=1567542> of the issue it says “It was discovered that the implementation of the NamedNodeMapImpl class in the JAXP component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.” It also includes the OpenJDK issue #. Looking for that change in the OpenJDK repository<http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/5279c6da822e> it shows a small change in readObject that is not found in the current Apache Xerces code.
Current Xerces code<https://github.com/apache/xerces2-j/blob/trunk/src/org/apache/xerces/dom/NamedNodeMapImpl.java#L604>:
private void readObject(ObjectInputStream in)
throws IOException, ClassNotFoundException {
in.defaultReadObject();
if (nodes != null) {
nodes = new ArrayList(nodes);
}
}
Current OpenJDK code<http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/file/5279c6da822e/src/com/sun/org/apache/xerces/internal/dom/NamedNodeMapImpl.java#l606>:
private void readObject(ObjectInputStream in)
throws IOException, ClassNotFoundException {
in.defaultReadObject();
if (nodes != null) {
// cast to Vector is required
nodes = new ArrayList((Vector)nodes);
}
}
Should this modification be made to Xerces? Do people agree that it’s a vulnerability?
Thanks,
David
Re: CVE-2018-2799
Posted by Gary Gregory <ga...@gmail.com>.
So the idea is that the code blows up if nodes is _not_ a Vector. But, a
Vector is not bound either. Is there more to the fix than that?
Gary
On Thu, Apr 19, 2018 at 12:16 PM, David Dillard <Da...@veritas.com>
wrote:
> Hi,
>
>
>
> Tuesday, Oracle released its Quarterly Critical Patch Update, which
> included some fixes for Java
> <http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html#AppendixJAVA>.
> I saw that one of those fixes was for JAXP (CVE-2018-2799). Going to Red
> Hat’s CVE database to get a real description
> <https://bugzilla.redhat.com/show_bug.cgi?id=1567542> of the issue it
> says “It was discovered that the implementation of the NamedNodeMapImpl
> class in the JAXP component of OpenJDK did not limit the amount of memory
> allocated when creating object instance from a serialized form. A
> specially-crafted input could cause a Java application to use an excessive
> amount of memory when deserialized.” It also includes the OpenJDK issue
> #. Looking for that change in the OpenJDK repository
> <http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/5279c6da822e> it shows a
> small change in readObject that is not found in the current Apache Xerces
> code.
>
>
>
> Current Xerces code
> <https://github.com/apache/xerces2-j/blob/trunk/src/org/apache/xerces/dom/NamedNodeMapImpl.java#L604>
> :
>
>
>
> private void readObject(ObjectInputStream in)
>
> throws IOException, ClassNotFoundException {
>
> in.defaultReadObject();
>
> if (nodes != null) {
>
> nodes = new ArrayList(nodes);
>
> }
>
> }
>
>
>
>
>
> Current OpenJDK code
> <http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/file/5279c6da822e/src/com/sun/org/apache/xerces/internal/dom/NamedNodeMapImpl.java#l606>
> :
>
>
>
> private void readObject(ObjectInputStream in)
>
> throws IOException, ClassNotFoundException {
>
> in.defaultReadObject();
>
> if (nodes != null) {
>
> // cast to Vector is required
>
> nodes = new ArrayList((Vector)nodes);
>
> }
>
> }
>
>
>
>
>
> Should this modification be made to Xerces? Do people agree that it’s a
> vulnerability?
>
>
>
> Thanks,
>
>
>
> David
>