CVE-2021-33813
Fixed in a distro release EPSS 19%
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
Products: jdom, apache solr, apache tika, debian_linux, fedoraproject fedora, oracle communications_messaging_server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jdom:jdom2 | 2.0.6.1 |
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| Maven | org.jdom:jdom |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | jdom | 1.1.3-6.1.amzn2.0.1 |
| Amazon Linux 2 | jdom-demo | 1.1.3-6.1.amzn2.0.1 |
| Amazon Linux 2 | jdom-javadoc | 1.1.3-6.1.amzn2.0.1 |
| Amazon Linux 2023 | jdom | 1.1.3-30.amzn2023.0.3 |
| Amazon Linux 2023 | jdom-demo | 1.1.3-30.amzn2023.0.3 |
| Amazon Linux 2023 | jdom-javadoc | 1.1.3-30.amzn2023.0.3 |
| Debian 12 | libjdom1-java | 1.1.3-2.1 |
| Debian 12 | libjdom2-intellij-java | no fix |
| Debian 12 | libjdom2-java | 2.0.6-2.1 |
| Debian 13 | libjdom1-java | 1.1.3-2.1 |
| Debian 13 | libjdom2-intellij-java | no fix |
| Debian 13 | libjdom2-java | 2.0.6-2.1 |
| Debian 14 | libjdom1-java | 1.1.3-2.1 |
| Debian 14 | libjdom2-intellij-java | no fix |
| Debian 14 | libjdom2-java | 2.0.6-2.1 |
| Debian 9 | libjdom1-java | 1.1.3-1+deb9u1 |
| Debian 9 | libjdom2-java | 2.0.6-1+deb9u1 |
| SUSE Enterprise Storage 6 | jdom | 1.1-150000.5.3.1 |
| SUSE Enterprise Storage 7.1 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Enterprise Storage 7.1 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Enterprise Storage 7.1 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Enterprise Storage 7.1 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Enterprise Storage 7.1 | junit | 4.13.2-150200.3.15.2 |
| SUSE Enterprise Storage 7.1 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Enterprise Storage 7.1 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jdom2 | 2.0.6-3.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jdom2 | 2.0.6-3.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | apiguardian | 1.1.2-150200.3.10.2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | assertj-core | 3.25.3-150200.5.4.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | byte-buddy | 1.14.16-150200.5.7.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | jopt-simple | 5.0.4-150200.3.4.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | junit5 | 5.10.2-150200.3.10.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | junit5-minimal | 5.10.2-150200.3.10.2 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | open-test-reporting | 0.1.0~M2-150200.5.7.2 |
| SUSE Linux Enterprise Server 15 SP1-BCL | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Server 15-LTSS | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | jdom | 1.1-150000.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | hamcrest | 2.2-150200.12.17.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | junit | 4.13.2-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | xom | 1.3.9-150200.5.3.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | jdom | 1.1.3-26.5.1 |
| SUSE Manager Proxy 4.3 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Manager Server 4.3 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Manager Server Module 4.3 | dom4j | 2.1.4-150200.12.10.2 |
| SUSE Manager Server Module 4.3 | jaxen | 2.0.0-150200.5.3.1 |
| SUSE Manager Server Module 4.3 | jdom | 1.1.3-150200.12.8.2 |
| SUSE Manager Server Module 4.3 | objectweb-asm | 9.7-150200.3.15.2 |
| SUSE Manager Server Module 4.3 | xom | 1.3.9-150200.5.3.3 |
| Ubuntu 14.04 LTS | libjdom1-java | no fix |
| Ubuntu 16.04 LTS | libjdom1-java | no fix |
| Ubuntu 16.04 LTS | libjdom2-java | no fix |
| Ubuntu 18.04 LTS | libjdom1-java | no fix |
| Ubuntu 18.04 LTS | libjdom2-java | no fix |
| Ubuntu 20.04 LTS | libjdom1-java | no fix |
| Ubuntu 20.04 LTS | libjdom2-java | no fix |
| Ubuntu 22.04 LTS | libjdom1-java | no fix |
| Ubuntu 22.04 LTS | libjdom2-java | no fix |
| Ubuntu 24.04 LTS | libjdom1-java | no fix |
| Ubuntu 24.04 LTS | libjdom2-java | no fix |
| Ubuntu 25.10 | libjdom1-java | no fix |
| Ubuntu 25.10 | libjdom2-java | no fix |
| Ubuntu 26.04 LTS | libjdom1-java | no fix |
| Ubuntu 26.04 LTS | libjdom2-java | no fix |
| Ubuntu 26.10 | libjdom1-java | no fix |
| Ubuntu 26.10 | libjdom2-java | no fix |
| openSUSE Leap 15.2 | jdom2 | 2.0.6-lp152.2.3.1 |
| openSUSE Leap 15.3 | jdom2 | 2.0.6-3.3.1 |
| openSUSE Leap 15.5 | apiguardian | 1.1.2-150200.3.10.2 |
| openSUSE Leap 15.5 | assertj-core | 3.25.3-150200.5.4.3 |
| openSUSE Leap 15.5 | byte-buddy | 1.14.16-150200.5.7.1 |
| openSUSE Leap 15.5 | dom4j | 2.1.4-150200.12.10.2 |
| openSUSE Leap 15.5 | hamcrest | 2.2-150200.12.17.2 |
| openSUSE Leap 15.5 | jaxen | 2.0.0-150200.5.3.1 |
| openSUSE Leap 15.5 | jdom | 1.1.3-150200.12.8.2 |
| openSUSE Leap 15.5 | jopt-simple | 5.0.4-150200.3.4.3 |
| openSUSE Leap 15.5 | junit | 4.13.2-150200.3.15.2 |
| openSUSE Leap 15.5 | junit5 | 5.10.2-150200.3.10.3 |
| openSUSE Leap 15.5 | junit5-minimal | 5.10.2-150200.3.10.2 |
| openSUSE Leap 15.5 | objectweb-asm | 9.7-150200.3.15.2 |
| openSUSE Leap 15.5 | open-test-reporting | 0.1.0~M2-150200.5.7.2 |
| openSUSE Leap 15.5 | saxpath | 1.0-150200.5.3.3 |
| openSUSE Leap 15.5 | xom | 1.3.9-150200.5.3.3 |
| openSUSE Leap 15.6 | apiguardian | 1.1.2-150200.3.10.2 |
| openSUSE Leap 15.6 | assertj-core | 3.25.3-150200.5.4.3 |
| openSUSE Leap 15.6 | byte-buddy | 1.14.16-150200.5.7.1 |
| openSUSE Leap 15.6 | dom4j | 2.1.4-150200.12.10.2 |
| openSUSE Leap 15.6 | hamcrest | 2.2-150200.12.17.2 |
| openSUSE Leap 15.6 | jaxen | 2.0.0-150200.5.3.1 |
| openSUSE Leap 15.6 | jdom | 1.1.3-150200.12.8.2 |
| openSUSE Leap 15.6 | jopt-simple | 5.0.4-150200.3.4.3 |
| openSUSE Leap 15.6 | junit | 4.13.2-150200.3.15.2 |
| openSUSE Leap 15.6 | junit5 | 5.10.2-150200.3.10.3 |
| openSUSE Leap 15.6 | junit5-minimal | 5.10.2-150200.3.10.2 |
| openSUSE Leap 15.6 | objectweb-asm | 9.7-150200.3.15.2 |
| openSUSE Leap 15.6 | open-test-reporting | 0.1.0~M2-150200.5.7.2 |
| openSUSE Leap 15.6 | saxpath | 1.0-150200.5.3.3 |
| openSUSE Leap 15.6 | xom | 1.3.9-150200.5.3.3 |
| openSUSE Tumbleweed | jdom | 1.1.3-40.1 |
| openSUSE Tumbleweed | jdom2 | 2.0.6-3.2 |