GHSA-qh3m-qw6v-qvhg

Moderate severity vulnerability that affects io.vertx:vertx-core

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-12544

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.vertx:vertx-core	>= 3.5.0, < 3.5.4	3.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-12544 advisory
https://github.com/vert-x3/vertx-web/issues/1021 web
https://github.com/vert-x3/vertx-web/commit/ac8692c618d6180a9bc012a2ac8dbec821b1a97 web
https://access.redhat.com/errata/RHSA-2018:2946 web
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539568 web
https://github.com/advisories/GHSA-qh3m-qw6v-qvhg advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E web