CVE-2018-12544: Vulnerability in io.vertx:vertx-core
Summary
CVE-2018-12544: Moderate severity vulnerability that affects io.vertx:vertx-core. Affects io.vertx:vertx-core versions >= 3.5.0, < 3.5.4. Fixed in 3.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.vertx:vertx-core package is a core component of Eclipse Vert.x, a toolkit for building reactive applications on the Java Virtual Machine. It provides a set of APIs for creating event-driven, non-blocking applications. This vulnerability affects versions 3.5.Beta1 to 3.5.3 of the package. The OpenAPI XML type validator in these versions creates XML parsers without proper defense against XML attacks when used to validate a provided schema.
Vulnerability Detail
The vulnerability in io.vertx:vertx-core allows for XML attacks when using the Eclipse Vert.x OpenAPI XML type validator. This can lead to various security issues, such as XML external entity (XXE) attacks, denial of service (DoS) attacks, or remote code execution. Attackers can exploit this vulnerability by providing a malicious schema for validation. The lack of appropriate defense mechanisms in the XML parser makes it susceptible to these attacks.
How To Fix
Minimum fixed version
3.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
In conclusion, the vulnerability in io.vertx:vertx-core allows for XML attacks when using the Eclipse Vert.x OpenAPI XML type validator. Upgrading to version 3.5.4 or later is recommended to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-core →
FAQ
This vulnerability can lead to XML attacks, potentially resulting in security breaches, data leaks, or unauthorized access to sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
No, only versions 3.5.Beta1 to 3.5.3 of io.vertx:vertx-core are affected. It is recommended to upgrade to version 3.5.4 or later to fix the vulnerability.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/advisories/GHSA-qh3m-qw6v-qvhg).
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-core.
