PT-2022-19295 · Apache · Apache Jena

🗓️ 05 May 2022 00:00:00Reported by Positive TechnologiesType

Apache Jena RDF XML parser vulnerability allows external DTD retrieval; upgrade to 4.4.0 or disable parser.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management is impacted by vulnerabilities in Apache Jena	13 Jan 202508:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz Reporting Service is affected by RDF/XML parser of Apache Jena	14 Jul 202611:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect for Virtual Environments is vulnerable to arbitrary code execution, sensitive information disclosure, and denial of service due to CVEs in Apache Velocity, Apache Jena, and XStream (woodstox)	17 Nov 202323:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing is vulnerable to a remote attack due to Apache Jena Core	4 Oct 202308:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to a remote attack due to Apache Jena (CVE-2021-39239, CVE-2022-28890, CVE-2023-22665).	3 Jul 202318:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities fixed in 9.7.2.7	24 Oct 202411:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Jazz Reporting Service is vulnerable to XML external entity (XXE) attacks due to a vulnerability in XML processing in Apache Jena, in versions up to 4.1.0 (CVE-2021-39239)	4 Oct 202307:46	–	ibm
ATTACKERKB	CVE-2022-28890	5 May 202209:15	–	attackerkb
Circl	CVE-2022-28890	5 May 202212:36	–	circl
CNNVD	Apache Jena 代码问题漏洞	5 May 202200:00	–	cnnvd

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-28890
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2022-28890
osv	www.osv.dev/vulnerability/CVE-2022-28890
ubuntu	www.ubuntu.com/security/CVE-2022-28890
osv	www.osv.dev/vulnerability/GHSA-gchv-364h-r896
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-28890
lists	www.lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
openwall	www.openwall.com/lists/oss-security/2022/05/04/1
gitbox	www.gitbox.apache.org/repos/asf/jena.git

25 Oct 2023 00:00Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19.8

CVSS 27.5

EPSS0.0247