Description
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | restlet | No fix yet | — |
| Ubuntu 16.04 LTS | restlet | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.restlet.jse:org.restlet | >= 2.1.0, < 2.1.7 | 2.1.7 | GHSA-73cq-fhp3-8rpw |
References
- 56940 third-party-advisory
- https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements
- restlet-framework-cve20141868-dos(91181) vdb-entry