Skip to content
OpenAdvisories
Medium ALAS2-2023-2089 1 CVE

Moderate: xmlrpc security update (Amazon Linux 2)

Published Jun 7, 2023 · Updated Jun 12, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5002: XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 xmlrpc-client 1:3.1.3-9.amzn2.0.2
Amazon Linux · 2 xmlrpc-common 1:3.1.3-9.amzn2.0.2
Amazon Linux · 2 xmlrpc-javadoc 1:3.1.3-9.amzn2.0.2
Amazon Linux · 2 xmlrpc-server 1:3.1.3-9.amzn2.0.2

Vulnerabilities 1

  • High 7.8
    CVE-2016-5002

    Apache XML-RPC XXE Vulnerability

    XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.

    org.apache.xmlrpc:xmlrpc Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-5002.html