java-sig-commits September 2015

java-sig-commits@lists.fedoraproject.org

3 participants
202 discussions

[Bug 1203762] CVE-2015-0250 batik: XML External Entity (XXE) injection in SVG parsing
by Red Hat Bugzilla 31 Aug '15

31 Aug '15

https://bugzilla.redhat.com/show_bug.cgi?id=1203762 --- Comment #6 from Jason Shepherd <jshepherd(a)redhat.com> --- For JBoss FSW, Apache Batik is used by BPEL Console, see: system/layers/soa/org/switchyard/component/bpel/main/module.xml  <module name="org.apache.xmlgraphics" /> If we check the source code for BPEL (downstream Riftsaw) we see it doesn't use the patched SAXDocumentFactory, it used DOMUtils to write an XML Document: https://github.com/riftsaw/riftsaw/blob/master/console/bpel2svg/src/main/ja… Similar to JBoss Fuse, the SVG functionality is there for rendering XML, not for parsing it. Updating fsw-6/batik to notaffected. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Mnft5VZknm&a=cc_unsubscribe _______________________________________________ java-sig-commits mailing list java-sig-commits(a)lists.fedoraproject.org http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedoraproje…

1 0

[Bug 1203762] CVE-2015-0250 batik: XML External Entity (XXE) injection in SVG parsing
by Red Hat Bugzilla 31 Aug '15

31 Aug '15

https://bugzilla.redhat.com/show_bug.cgi?id=1203762 Jason Shepherd <jshepherd(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jshepherd(a)redhat.com --- Comment #5 from Jason Shepherd <jshepherd(a)redhat.com> --- For JBoss Fuse, Apache Batik is used by the camel-fop component to render messages into SVG Image+XML. See: https://git-wip-us.apache.org/repos/asf?p=camel.git;a=blob;f=components/cam… The vulnerability fixed an issue with the way SVG parses XML, not with the way it produces it. Therefore the issue doesn't effect JBoss Fuse 6.2.0. Add jboss/fuse=notaffected -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=i1Cr8wFihz&a=cc_unsubscribe _______________________________________________ java-sig-commits mailing list java-sig-commits(a)lists.fedoraproject.org http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedoraproje…

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits September 2015