Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Résumé
Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-53689 jackrabbit
- Ubuntu UBUNTU-CVE-2025-53689 jackrabbit
Références
- advisory github.com
- advisory lists.apache.org
- advisory nvd.nist.gov
- web openwall.com