exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Spase Markovski

Spring MVC 3.2.8 / 4.0.1 Incomplete Fix

Posted Mar 12, 2014

Authored by Pivotal Security Team, Spase Markovski

Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and that processing is now disabled by default. Versions 3.0.0 through 3.2.8 and 4.0.0 through 4.0.1 are affected.

tags | advisory, xxe

advisories | CVE-2014-0054, CVE-2013-4152, CVE-2013-6429

SHA-256 | 99a8ad7c850c897b9d19d09b3e771b91512dc689e5f940a3f5f0bfee478e8189

Download | Favorite | View