Improperly Implemented Security Check for Standard The advisory has been revoked - it doesn't affect any version of package xalan-j2 (opens in a new tab)

Threat Intelligence

14.07% (97^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL10-XALANJ2-9854814
published28 Apr 2025
disclosed24 Mar 2014

Report a new vulnerability Found a mistake?

Introduced: 24 Mar 2014

CVE-2014-0107 (opens in a new tab) CWE-358 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xalan-j2 package and not the xalan-j2 package as distributed by RHEL.

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.