Description
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xmlrpc-client +3 | 1:3.1.3-9.amzn2.0.2 | ALAS2-2023-2089 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.xmlrpc:xmlrpc | <= 3.1.3 | — | GHSA-wp35-6jqv-r33m |
Advisories 1
- ALAS2-2023-2089 Moderate: xmlrpc security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2023
References
- [oss-security] 20160712 Vulnerabilities in Apache Archiva mailing-list
- 1036294 vdb-entry
- https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
- apache-archiva-cve20165002-ssrf(115042) vdb-entry
- 91736 vdb-entry
- RHSA-2018:3768 vendor-advisory
- https://security.gentoo.org/glsa/202401-26