CVE-2014-3574: Improper Input Validation in Apache POI
Summary
CVE-2014-3574: Improper Input Validation in Apache POI. Affects org.apache.poi:poi across 2 version ranges.
< 3.10.1
>= 3.11-beta1, < 3.11-beta2
Fixed in 3.10.1 or 3.11-beta2, depending on the release line you run. How to fix ↓
Also tracked for
- libapache-poi-java · Debian:11
The same CVE-2014-3574 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache POI is a Java library for reading and writing Microsoft Office file formats, such as Word, Excel, and PowerPoint. It provides APIs to manipulate these files programmatically. The vulnerability identified as CVE-2014-3574 affects Apache POI versions before 3.10.1 and 3.11.x before 3.11-beta2. This vulnerability allows remote attackers to cause a denial of service (CPU consumption and crash) by exploiting a crafted OOXML file, specifically through an XML Entity Expansion (XEE) attack.
Vulnerability Detail
The vulnerability in Apache POI arises from improper input validation. By sending a specially crafted OOXML file, an attacker can trigger an XML Entity Expansion attack. This attack can lead to excessive CPU consumption and ultimately crash the application. The vulnerability is considered moderate in severity and has been assigned CWE-20 as its Common Weakness Enumeration identifier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.10.13.10.1 -
>= 3.11-beta1, < 3.11-beta23.11-beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix instructions and update to the latest secure version of Apache POI.
Conclusion
The vulnerability in Apache POI (CVE-2014-3574) allows remote attackers to cause a denial of service by exploiting a crafted OOXML file. It is crucial to update to the fixed versions of Apache POI to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.poi:poi →
FAQ
Apache POI is a Java library for manipulating Microsoft Office file formats programmatically.
The vulnerability allows remote attackers to cause a denial of service by exploiting a crafted OOXML file, leading to excessive CPU consumption and application crashes.
An XML Entity Expansion attack is a type of attack where an attacker exploits the ability of XML parsers to expand entities, resulting in excessive resource consumption and potential denial of service.
The vulnerability is considered moderate in severity.
Updating Apache POI to version 3.10.1 or later (for versions prior to 3.11) or version 3.11-beta2 or later (for version 3.11-beta1) will mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.poi:poi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
