CVE-2013-4152
Fixed in a distro release EPSS 26%
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Products: springsource spring_framework, vmware spring_framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring-oxm | 3.2.4.RELEASE |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libspring-java | 3.0.6.RELEASE-10 |
| Debian 13 | libspring-java | 3.0.6.RELEASE-10 |
| Debian 14 | libspring-java | 3.0.6.RELEASE-10 |
| Debian 7 | libspring-java | 3.0.6.RELEASE-6+deb7u1 |
| Red Hat openshift 1.2 | activemq | 0:5.9.0-4.redhat.610328.el6op |
| Red Hat openshift 1.2 | activemq-client | 0:5.9.0-4.redhat.610328.el6op |
| Red Hat openshift 2.0 | activemq | 0:5.9.0-4.redhat.610328.el6op |
| Red Hat openshift 2.0 | activemq-client | 0:5.9.0-4.redhat.610328.el6op |