Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2026-24400

crítica

CVE-2026-24400

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

Publicada Modificada CWE 611
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N
Red Hat6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Azure Linux (alta), Red Hat (media), AlmaLinux (media), Amazon (media), Oracle (media), Rocky Linux (media).

Descripción

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
alma 10assertj-core, assertj-core-javadoc3.24.2-9.el10_2.1
alma 9assertj-core3.19.0-9.el9_8.1
amazon linux 2023assertj-core, assertj-core-javadoc, javapackages-bootstrap3.19.0-5.amzn2023.0.4 y 1 más
Azure Linux 3.0javapackages-bootstrap0:1.14.0-4.azl3
debian 11assertj-coresin corrección indicada
debian 12assertj-coresin corrección indicada
debian 13assertj-coresin corrección indicada
debian 14assertj-coresin corrección indicada
echoassertj-coresin corrección indicada
maven::GitHub Security Advisory Mavenorg.assertj:assertj-core3.27.7
Oracle Linux 9assertj-core3.19.0-9.el9_8.1
rapidfort alma 10assertj-core, assertj-core-javadoc0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
Mostrar las 31 entradas de 22 fuentes
FuentePaqueteCorregido en
alma 10assertj-core3.24.2-9.el10_2.1
alma 10assertj-core-javadoc3.24.2-9.el10_2.1
alma 9assertj-core3.19.0-9.el9_8.1
amazon linux 2023assertj-core3.19.0-5.amzn2023.0.4
amazon linux 2023assertj-core-javadoc3.19.0-5.amzn2023.0.4
amazon linux 2023javapackages-bootstrap1.5.0^20220105.git9f283b7-3.amzn2023.0.8
Azure Linux 3.0javapackages-bootstrap0:1.14.0-4.azl3
debian 11assertj-coresin corrección indicada
debian 12assertj-coresin corrección indicada
debian 13assertj-coresin corrección indicada
debian 14assertj-coresin corrección indicada
echoassertj-coresin corrección indicada
maven::GitHub Security Advisory Mavenorg.assertj:assertj-core3.27.7
Oracle Linux 9assertj-core3.19.0-9.el9_8.1
rapidfort alma 10assertj-core0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
rapidfort alma 10assertj-core-javadoc0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
rapidfort alma 9assertj-core3.19.0-9.el9_8.1
rapidfort amazon linux 2023assertj-core3.19.0-5.amzn2023.0.4
rapidfort amazon linux 2023assertj-core-javadoc3.19.0-5.amzn2023.0.4
rapidfort debian 12assertj-coresin corrección indicada
rapidfort debian 13assertj-coresin corrección indicada
rapidfort Oracle Linux 10assertj-core0:3.24.2-9.el10_2.1
rapidfort Oracle Linux 9assertj-core0:3.19.0-9.el9_8.1
rapidfort rocky 9assertj-core0:3.19.0-9.el9_8.1
Red Hatjavapackages-tools:201801::assertj-coresin corrección indicada
Red Hatjavapackages-tools:201801::assertj-core-javadocsin corrección indicada
Red Hatlog4jsin corrección indicada
Red Hatlog4j-jclsin corrección indicada
Red Hatlog4j-slf4jsin corrección indicada
rocky 10assertj-core3.24.2-9.el10_2.1
rocky 9assertj-core3.19.0-9.el9_8.1

Referencias

Las 17 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.