CVE-2021-39239: XML External Entity Reference in Apache Jena
Summary
CVE-2021-39239: XML External Entity Reference in Apache Jena. Affects org.apache.jena:jena-core versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Also tracked for
- apache-jena · Debian:12
The same CVE-2021-39239 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Jena is a Java framework for building Semantic Web and Linked Data applications. It provides a set of APIs and tools for working with RDF data, SPARQL queries, and RDF storage. The Apache Jena package, specifically the jena-core component, is impacted by a vulnerability that allows for XML External Entity (XXE) attacks. This vulnerability exists in versions up to 4.1.0 of Apache Jena.
Vulnerability Detail
The vulnerability in Apache Jena arises from improper XML processing, which enables an attacker to execute XML External Entities (XXE) attacks. By exploiting this vulnerability, an attacker can potentially expose the contents of local files to a remote server. This can lead to unauthorized access, data leakage, and other security breaches.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can disable XML external entity resolution in their application's XML processing configuration. This can be achieved by configuring the XML parser to disallow external entity references. However, this workaround may impact the functionality of the application and is not a long-term solution. It is strongly advised to apply the official fix by upgrading to a patched version of Apache Jena.
Conclusion
The vulnerability in Apache Jena, CVE-2021-39239, exposes the software to XML External Entity (XXE) attacks. It is crucial to apply the recommended fix by upgrading to version 4.2.0 or later of the Apache Jena jena-core package. Developers should also consider using Vulert's playground to check if their application is affected by this vulnerability. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.apache.jena:jena-core →
FAQ
Apache Jena is a Java framework for building Semantic Web and Linked Data applications. It provides APIs and tools for working with RDF data, SPARQL queries, and RDF storage.
XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to exploit weakly configured XML parsers and gain unauthorized access to local files or perform other malicious actions.
The vulnerability in Apache Jena can lead to unauthorized access to sensitive data, data leakage, and other security breaches. It may also enable an attacker to execute arbitrary code or perform remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-7rp6-w7mg-h8rw/GHSA-7rp6-w7mg-h8rw.json
