Lucene search

AmazonALAS2-2023-2045

HistoryMay 11, 2023 - 5:49 p.m.

Medium: jdom

2023-05-1117:49:00

alas.aws.amazon.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.005 Low

EPSS

Percentile

75.6%

JSON

Issue Overview:

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. (CVE-2021-33813)

Affected Packages:

jdom

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update jdom to update your system.

New Packages:

noarch:  
    jdom-1.1.3-6.1.amzn2.0.1.noarch  
    jdom-javadoc-1.1.3-6.1.amzn2.0.1.noarch  
    jdom-demo-1.1.3-6.1.amzn2.0.1.noarch  
  
src:  
    jdom-1.1.3-6.1.amzn2.0.1.src

Additional References

Red Hat: CVE-2021-33813

Mitre: CVE-2021-33813

OSVersionArchitecturePackageVersionFilename
Amazon Linux2noarchjdom< 1.1.3-6.1.amzn2.0.1jdom-1.1.3-6.1.amzn2.0.1.noarch.rpm
Amazon Linux2noarchjdom-javadoc< 1.1.3-6.1.amzn2.0.1jdom-javadoc-1.1.3-6.1.amzn2.0.1.noarch.rpm
Amazon Linux2noarchjdom-demo< 1.1.3-6.1.amzn2.0.1jdom-demo-1.1.3-6.1.amzn2.0.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	noarch	jdom	< 1.1.3-6.1.amzn2.0.1	jdom-1.1.3-6.1.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	jdom-javadoc	< 1.1.3-6.1.amzn2.0.1	jdom-javadoc-1.1.3-6.1.amzn2.0.1.noarch.rpm
Amazon Linux	2	noarch	jdom-demo	< 1.1.3-6.1.amzn2.0.1	jdom-demo-1.1.3-6.1.amzn2.0.1.noarch.rpm