Description
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Platform 5 | picketlink-federation | 2.1.5-3_patch_01.el6_5 | RHSA-2014:0898 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.9-5.SP3_redhat_2.1.ep6.el5 | RHSA-2014:0883 |
| Red Hat JBoss EAP 5 | picketlink-federation | 2.1.5-3_patch_01.el6_5 | RHSA-2014:0885 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.picketlink:picketlink-common | < 2.7.0.Final | 2.7.0.Final | GHSA-2c9q-qwrc-f486 |
Advisories 3
- RHSA-2014:0883 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2014:0885 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2014:0898 Red Hat Security Advisory: Red Hat JBoss Enterprise Web Platform 5.2.0 security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- RHSA-2014:0886 vendor-advisory
- RHSA-2014:0885 vendor-advisory
- RHSA-2015:0765 vendor-advisory
- 60124 third-party-advisory
- RHSA-2015:0675 vendor-advisory
- RHSA-2015:0720 vendor-advisory
- RHSA-2014:0884 vendor-advisory
- RHSA-2015:1888 vendor-advisory
- RHSA-2015:0091 vendor-advisory
- 60047 third-party-advisory
- RHSA-2014:0883 vendor-advisory
- 1030607 vdb-entry
- jboss-cve20143530-info-disc(94700) vdb-entry