CVE-2014-3530

CVE-2014-3530 affects Red Hat JBoss EAP/JBoss SOA Platform components using the PicketLink library. The root cause is in org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory(), which expands entity references and enables XML External Entity (XXE) processing. This can allow a remote a...