[
https://issues.apache.org/jira/browse/XERCESJ-1748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17604876#comment-17604876
]
Michael Glavassevich commented on XERCESJ-1748:
-----------------------------------------------
Xerces relies on the JDK for parsing URLs and opening connections to them. How
is Xerces different than any other client of java.net.URL? Is this not
potentially a problem for any code that use that API? Trying to understand why
this is considered an issue with Xerces and not the JDK.
> sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)
> ----------------------------------------------------------------
>
> Key: XERCESJ-1748
> URL: https://issues.apache.org/jira/browse/XERCESJ-1748
> Project: Xerces2-J
> Issue Type: Bug
> Reporter: Albert Wang
> Priority: Major
>
> OSSIndex published a vulnerability in xercesImpl:xerces:2.12.2.
>
> _*[[sonatype-2017-0348] CWE-833:
> Deadlock|https://ossindex.sonatype.org/vulnerability/sonatype-2017-0348]*_
> _Description_
> _sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS)_
> _The software contains multiple threads or executable segments that are
> waiting for each other to release a necessary lock, resulting in deadlock._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscr...@xerces.apache.org
For additional commands, e-mail: j-dev-h...@xerces.apache.org
