7.1

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Xerces-j Version <= 2.12.1
Oracle ≫ Banking Party Management Version 2.7.0
Oracle ≫ Communications Asap Version 7.3
Oracle ≫ Financial Services Behavior Detection Platform Version >= 8.0.6.0.0 <= 8.0.8.0
Oracle ≫ Flexcube Universal Banking Version 12.4.0
Oracle ≫ Global Lifecycle Management Opatch Version < 12.2.0.1.30
Oracle ≫ Health Sciences Information Manager Version >= 3.0.1 <= 3.0.5
Oracle ≫ Ilearning Version 6.2
Oracle ≫ Ilearning Version 6.3
Oracle ≫ Primavera Gateway Version >= 17.7 <= 17.12.11
Oracle ≫ Primavera Gateway Version >= 18.8.0 <= 18.8.14
Oracle ≫ Primavera Gateway Version >= 19.12.0 <= 19.12.13
Oracle ≫ Primavera Gateway Version >= 20.12.0 <= 20.12.8
Oracle ≫ Retail Bulk Data Integration Version 16.0.3.0
Oracle ≫ Retail Financial Integration Version 14.1.3.2
Oracle ≫ Retail Financial Integration Version 15.0.3.1
Oracle ≫ Retail Integration Bus Version 14.1.3.2
Oracle ≫ Retail Integration Bus Version 15.0.3.1
Oracle ≫ Retail Integration Bus Version 16.0.3
Oracle ≫ Retail Integration Bus Version 19.0.1
Oracle ≫ Retail Merchandising System Version 16.0.3
Oracle ≫ Retail Merchandising System Version 19.0.1
Oracle ≫ Retail Service Backbone Version 14.1.3.2
Oracle ≫ Retail Service Backbone Version 15.0.3.1
Oracle ≫ Retail Service Backbone Version 16.0.3
Oracle ≫ Retail Service Backbone Version 19.0.1
Oracle ≫ Weblogic Server Version 12.2.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 14.1.1.0.0
Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.44% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NIST 7.1 8.6 6.9
AV:N/AC:M/Au:N/C:N/I:N/A:C
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/24/3
Third Party Advisory
Mailing List
https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
Vendor Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20221028-0005/
Third Party Advisory