CVE-2015-0254
Description
It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution.
Statement
Users of EAP 6.x and 7.0 should upgrade to at least 6.4.9 and pass the following system property on startup to prevent XXE attacks in JSTL: org.apache.taglibs.standard.xml.accessExternalEntity=false
For more details please see refer to this KCS solution: https://access.redhat.com/solutions/1584363
Mitigation
Users should upgrade to Apache Standard Taglibs 1.2.3 or later.
This version uses JAXP’s FEATURE_SECURE_PROCESSING to restrict XML processing. Depending on the Java runtime version in use, additional configuration may be required:
Java8:
External entity access is automatically disabled if a SecurityManager is active.
Java7:
JAXP properties may need to be used to disable external access. See http://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html
Java6 and earlier:
A new system property org.apache.taglibs.standard.xml.accessExternalEntity may be used to specify the protocols that can be used to access external entities. This defaults to "all" if no SecurityManager is present and to "" (thereby disabling access) if a SecurityManager is detected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.6 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Access Complexity | Medium | Low | N/A |
| Authentication | None | None | N/A |
| Confidentiality Impact | Partial | Partial | N/A |
| Integrity Impact | Partial | Partial | N/A |
| Availability Impact | Partial | Partial | N/A |
Vector
Red Hat: AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD: AV:N/AC:L/Au:N/C:P/I:P/A:P
Acknowledgements
Red Hat would like to thank Apache Software Foundation and David Jorm (IIX) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
