Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2026-49875

kritik

CVE-2026-49875

cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening

Yayın Değişiklik CWE 611
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (yüksek).

Açıklama

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
maven::GitHub Security Advisory Mavenorg.apache.cxf:cxf-core4.2.2, 4.1.7, 3.6.12
chainguardwso2is0
echo maven::Echo OSVorg.apache.cxf:cxf-core4.1.7
Red Hatcxf-coredüzeltme belirtilmemiş
seal maven::Seal Security Databaseorg.apache.cxf:cxf-core, seal.sp1.org.apache.cxf:cxf-core, seal.sp2.org.apache.cxf:cxf-core ve 1 tane daha3.2.6+sp999, 3.5.9+sp999 ve 1 tane daha
5 kaynaktaki 8 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
maven::GitHub Security Advisory Mavenorg.apache.cxf:cxf-core4.2.2, 4.1.7, 3.6.12
chainguardwso2is0
echo maven::Echo OSVorg.apache.cxf:cxf-core4.1.7
Red Hatcxf-coredüzeltme belirtilmemiş
seal maven::Seal Security Databaseorg.apache.cxf:cxf-core3.2.6+sp999, 3.5.9+sp999
seal maven::Seal Security Databaseseal.sp1.org.apache.cxf:cxf-core3.2.6+sp999, 3.5.9+sp999
seal maven::Seal Security Databaseseal.sp2.org.apache.cxf:cxf-core3.5.9+sp999
seal maven::Seal Security Databaseseal.sp3.org.apache.cxf:cxf-core3.5.9+sp999

Referanslar

13 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.