You are viewing a plain text version of this content. The canonical link for it is here.
Posted to j-dev@xerces.apache.org by "Albert Wang (Jira)" <xe...@xml.apache.org> on 2022/08/03 00:06:00 UTC
[jira] [Comment Edited] (XERCESJ-1748) sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
[ https://issues.apache.org/jira/browse/XERCESJ-1748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17574431#comment-17574431 ]
Albert Wang edited comment on XERCESJ-1748 at 8/3/22 12:05 AM:
---------------------------------------------------------------
Hi [~ggregory], more information about the issue.
Here is a [SNYK security ticket|https://security.snyk.io/vuln/SNYK-JAVA-XERCES-31497]. The ticket mentions that the issue has been resolved by patch 2.11.0.
Based on a [comment|https://github.com/jeremylong/DependencyCheck/issues/4614#issuecomment-1203233304] on Github, the issue was not resolved within Xerces itself (still fully relying on Java defaults to provide sensible timeouts), but it's only resolved because the JDK has built in a default timeout for FTP connections in response to the CVE, so that over time the connections will time out and release the hanging thread with a timeout exception.
In [Hans Aikema|https://github.com/aikebah]'s view, this default timeout is still large enough to warrant the OSSINDEX security team to keep the issue for Xerces open (with a 300k millisec timeout an attacker may well be capable of triggering at least a significant service degradation).
Thank you.
Regards,
Albert
was (Author: JIRAUSER293781):
Hi [~ggregory], more information about the issue.
Here is a [SNYK security ticket|[https://security.snyk.io/vuln/SNYK-JAVA-XERCES-31497]. The ticket mentions that the issue has been resolved by patch 2.11.0.
Based on a [comment|https://github.com/jeremylong/DependencyCheck/issues/4614#issuecomment-1203233304] on Github, the issue was not resolved within Xerces itself (still fully relying on Java defaults to provide sensible timeouts), but it's only resolved because the JDK has built in a default timeout for FTP connections in response to the CVE, so that over time the connections will time out and release the hanging thread with a timeout exception.
In [Hans Aikema|https://github.com/aikebah]'s view, this default timeout is still large enough to warrant the OSSINDEX security team to keep the issue for Xerces open (with a 300k millisec timeout an attacker may well be capable of triggering at least a significant service degradation).
Thank you.
Regards,
Albert
> sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
> ----------------------------------------------------------------
>
> Key: XERCESJ-1748
> URL: https://issues.apache.org/jira/browse/XERCESJ-1748
> Project: Xerces2-J
> Issue Type: Bug
> Reporter: Albert Wang
> Priority: Major
>
> OSSIndex published a vulnerability in xercesImpl:xerces:2.12.2.
>
> _*[[sonatype-2017-0348] CWE-833: Deadlock|https://ossindex.sonatype.org/vulnerability/sonatype-2017-0348]*_
> _Description_
> _sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)_
> _The software contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org