Infinite Loop Vulnerability in Apache Xerces Java XML Parser (libxerces2-java)
Summary
DEBIAN-CVE-2022-23437: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. Affects libxerces2-java versions < 2.12.2-1. Fixed in 2.12.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxerces2-java is a widely used XML parser for Java applications, developed by the Apache Software Foundation. It provides a robust and efficient way to process XML documents, enabling developers to read, manipulate, and validate XML data. However, certain versions of this library are susceptible to a critical vulnerability that can lead to resource exhaustion.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2022-23437 exists within the Apache Xerces Java (XercesJ) XML parser. It arises when the parser processes specially crafted XML document payloads, causing it to enter an infinite loop. This behavior can lead to excessive consumption of system resources, potentially resulting in denial of service. The issue affects versions prior to 2.12.2-1, specifically version 2.12.1 and earlier.
How To Fix
Minimum fixed version
2.12.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxerces2-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider validating XML documents before processing them with the XercesJ parser to avoid triggering the infinite loop. Additionally, monitor system resource usage closely when handling untrusted XML inputs.
Conclusion
The vulnerability in the Apache Xerces Java XML parser poses a significant risk to applications using affected versions of libxerces2-java. It is crucial to update to the latest version to mitigate potential denial of service attacks. Regular monitoring and validation of XML inputs are also recommended to enhance security.
See every vulnerability recorded for libxerces2-java →
FAQ
The vulnerability causes the XercesJ XML parser to enter an infinite loop when processing certain XML documents, leading to resource exhaustion.
Versions prior to 2.12.2-1, specifically 2.12.1 and earlier, are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to denial of service by consuming excessive system resources, which may disrupt application performance.
Yes, updating to the patched version of libxerces2-java (2.12.2-1 or later) is the recommended permanent fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxerces2-java.
