このページは Ubuntu 向けの修正状況です。脆弱性そのものの説明は CVE 本体のページにあります。
CVE-2026-92877 の詳細 →
UBUNTU-CVE-2026-92877
The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementa...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The JAXB factory methods historically relied solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
出典: OSV.dev (Open Source Vulnerabilities) OSV
影響パッケージ
Ubuntu:16.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
jaxb
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
参照URL
- report ubuntu.com
- report cve.org
- report github.com
- report gitlab.eclipse.org