[
https://issues.apache.org/jira/browse/XERCESJ-1748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17574431#comment-17574431
]
Albert Wang edited comment on XERCESJ-1748 at 8/3/22 12:05 AM:
---------------------------------------------------------------
Hi [~ggregory], more information about the issue.
Here is a [SNYK security
ticket|https://security.snyk.io/vuln/SNYK-JAVA-XERCES-31497]. The ticket
mentions that the issue has been resolved by patch 2.11.0.
Based on a
[comment|https://github.com/jeremylong/DependencyCheck/issues/4614#issuecomment-1203233304]
on Github, the issue was not resolved within Xerces itself (still fully
relying on Java defaults to provide sensible timeouts), but it's only resolved
because the JDK has built in a default timeout for FTP connections in response
to the CVE, so that over time the connections will time out and release the
hanging thread with a timeout exception.
In [Hans Aikema|https://github.com/aikebah]'s view, this default timeout is
still large enough to warrant the OSSINDEX security team to keep the issue for
Xerces open (with a 300k millisec timeout an attacker may well be capable of
triggering at least a significant service degradation).
Thank you.
Regards,
Albert
was (Author: JIRAUSER293781):
Hi [~ggregory], more information about the issue.
Here is a [SNYK security
ticket|[https://security.snyk.io/vuln/SNYK-JAVA-XERCES-31497]. The ticket
mentions that the issue has been resolved by patch 2.11.0.
Based on a
[comment|https://github.com/jeremylong/DependencyCheck/issues/4614#issuecomment-1203233304]
on Github, the issue was not resolved within Xerces itself (still fully
relying on Java defaults to provide sensible timeouts), but it's only resolved
because the JDK has built in a default timeout for FTP connections in response
to the CVE, so that over time the connections will time out and release the
hanging thread with a timeout exception.
In [Hans Aikema|https://github.com/aikebah]'s view, this default timeout is
still large enough to warrant the OSSINDEX security team to keep the issue for
Xerces open (with a 300k millisec timeout an attacker may well be capable of
triggering at least a significant service degradation).
Thank you.
Regards,
Albert
> sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
> ----------------------------------------------------------------
>
> Key: XERCESJ-1748
> URL: https://issues.apache.org/jira/browse/XERCESJ-1748
> Project: Xerces2-J
> Issue Type: Bug
> Reporter: Albert Wang
> Priority: Major
>
> OSSIndex published a vulnerability in xercesImpl:xerces:2.12.2.
>
> _*[[sonatype-2017-0348] CWE-833:
> Deadlock|https://ossindex.sonatype.org/vulnerability/sonatype-2017-0348]*_
> _Description_
> _sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)_
> _The software contains multiple threads or executable segments that are
> waiting for each other to release a necessary lock, resulting in deadlock._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscr...@xerces.apache.org
For additional commands, e-mail: j-dev-h...@xerces.apache.org
