org.springframework:spring-oxm@3.2.1.RELEASE vulnerabilities
latest version
6.2.1
latest non vulnerable version
first published
15 years ago
latest version published
14 days ago
licenses detected
- [0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.springframework:spring-oxm package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.springframework:spring-oxm is a Spring Object/XML Marshalling library. Affected versions of this package are vulnerable to Denial of Service (DoS). It does not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file. How to fix Denial of Service (DoS)? Upgrade | [3.2.0.RELEASE,3.2.14.RELEASE)[4.0.0.RELEASE,4.1.7.RELEASE) |
org.springframework:spring-oxm is a Spring Object/XML Marshalling library. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. This is due to not disabling the resolution of URI references by default in a DTD declaration. This occurs only when processing user provided XML documents. How to fix XML External Entity (XXE) Injection? Upgrade | [3.0.0.RELEASE,3.2.9.RELEASE)[4.0.0.RELEASE,4.0.5.RELEASE) |
org.springframework:spring-oxm is a Spring Object/XML Marshalling library. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue. How to fix XML External Entity (XXE) Injection? Upgrade | [3.0.0.RELEASE,3.2.3.RELEASE)[4.0.0.RELEASE,4.0.1.RELEASE) |