CVE-2022-23437
Summary
| CVE | CVE-2022-23437 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-01-24 15:15:00 UTC |
| Updated | 2023-08-08 14:22:00 UTC |
| Description | There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions. |
Risk And Classification
Problem Types: CWE-835
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| N/A | CONFIRM | lists.apache.org | |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| oss-security - CVE-2022-23437: Infinite loop within Apache XercesJ xml parser | MLIST | www.openwall.com | |
| CVE-2022-23437 Apache XercesJ Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: This issue was discovered by Sergey Temnikov and Ziyi Luo, from Amazon Corretto/JDK Team
Legacy QID Mappings
- 150538 Oracle WebLogic Server Multiple Vulnerabilities (CPUAPR2022)
- 150588 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2022)
- 240458 Red Hat Update for JBoss Enterprise Application Platform 7.4.5 on RHEL 7 (RHSA-2022:4918)
- 240459 Red Hat Update for JBoss Enterprise Application Platform 7.4.5 on RHEL 8 (RHSA-2022:4919)
- 671576 EulerOS Security Update for xerces-j2 (EulerOS-SA-2022-1555)
- 671600 EulerOS Security Update for xerces-j2 (EulerOS-SA-2022-1592)
- 671719 EulerOS Security Update for xerces-j2 (EulerOS-SA-2022-1772)
- 751728 SUSE Enterprise Linux Security Update for xerces-j2 (SUSE-SU-2022:0500-1)
- 751729 SUSE Enterprise Linux Security Update for xerces-j2 (SUSE-SU-2022:0503-1)
- 751734 SUSE Enterprise Linux Security Update for xerces-j2 (SUSE-SU-2022:0542-1)
- 751745 OpenSUSE Security Update for xerces-j2 (openSUSE-SU-2022:0503-1)
- 751746 OpenSUSE Security Update for xerces-j2 (openSUSE-SU-2022:0500-1)
- 753451 SUSE Enterprise Linux Security Update for xerces-j2 (SUSE-SU-2022:14889-1)
- 87489 Oracle WebLogic Server Multiple Vulnerabilities (CPUAPR2022)
- 87524 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2022)