db-derby-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (DERBY-6807) XXE attack possible by using XmlVTI and the XML datatype
Date Thu, 11 Jun 2015 02:27:00 GMT

    [ https://issues.apache.org/jira/browse/DERBY-6807?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14581357#comment-14581357
] 

ASF subversion and git services commented on DERBY-6807:
--------------------------------------------------------

Commit 1684807 from [~bryanpendleton] in branch 'code/trunk'
[ https://svn.apache.org/r1684807 ]

DERBY-6810: Add regression tests for XXE vulnerability.

This patch was contributed by Abhinav Gupta (abhinavgupta2004 at gmail dot com)

This change adds a new regression test suite to hold tests for XXE
vulnerabilities in XML data type processing.

The new test case is in a suite by its own because we want to control the
overall security configuration (e.g., we want to ensure that no security
manager is installed).

Over time, as other types of XXE vulnerabilities are studied, we can add
additional test cases to this test suite.

Note that this test case demonstrates incorrect behavior, we believe. When
DERBY-6807 is fixed, this test case will need to be changed accordingly.

> XXE attack possible by using XmlVTI and the XML datatype
> --------------------------------------------------------
>
>                 Key: DERBY-6807
>                 URL: https://issues.apache.org/jira/browse/DERBY-6807
>             Project: Derby
>          Issue Type: Bug
>    Affects Versions: 10.11.1.1
>            Reporter: Rick Hillegas
>         Attachments: error-stacktrace.out, xmltest.diff
>
>
> The Derby XML datatype and XmlVTI can be exploited, via XXE-based attacks, to expose
sensitive information or launch denial-of-service assaults. This issue has CVE id CVE-2015-1832.
This issue was brought to our attention by Philippe Arteau.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message