Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: P4
Fix Version/s: 8.2.0
Affects Version/s: None
Component/s: Mission Control Core
Labels:
- security

Subcomponent:
BCI Agent
Sprint:
JMC 8.2 Sprint 2

Issue	Fix Version	Assignee	Priority	Status	Resolution	Resolved In Build
JMC-7424	8.1.1	Marcus Hirt	P4	Resolved	Fixed
JMC-7711	8.0.1	Marcus Hirt	P4	Resolved	Fixed

Our security vulnerabilities scanner found insecure XML parsing:

https://github.com/openjdk/jmc/blob/master/agent/src/main/java/org/openjdk/jmc/agent/impl/DefaultTransformRegistry.java#L127

https://github.com/openjdk/jmc/blob/master/agent/src/main/java/org/openjdk/jmc/agent/impl/DefaultTransformRegistry.java#L155

https://github.com/openjdk/jmc/blob/master/agent/src/main/java/org/openjdk/jmc/agent/impl/DefaultTransformRegistry.java#L495

Type of attack: XML External Entity(XXE) injection (https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)

Prevention: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

backported by

JMC-7424 Update XML parsing

Resolved

JMC-7711 Update XML parsing

Resolved

links to

Commit openjdk/jmc/90197d63

Review openjdk/jmc/320

Assignee:: Evgeny Astigeevich

Reporter:: Evgeny Astigeevich

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Created:: 2021-10-12 07:25

Updated:: 2022-04-06 22:26

Resolved:: 2021-10-13 12:50