Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
概要
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-53689 jackrabbit
- Ubuntu UBUNTU-CVE-2025-53689 jackrabbit
参照URL
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com