security.snyk.io Open in urlscan Pro
2a02:26f0:fb:5b0::ecd  Public Scan

Form analysis
2 forms found in the DOM

<form id="mktoForm_1461" style="display: none; font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); width: 1px;" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft">
  <style type="text/css">
    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton {
      color: #fff;
      border: 1px solid #75ae4c;
      padding: 0.4em 1em;
      font-size: 1em;
      background-color: #99c47c;
      background-image: -webkit-gradient(linear, left top, left bottom, from(#99c47c), to(#75ae4c));
      background-image: -webkit-linear-gradient(top, #99c47c, #75ae4c);
      background-image: -moz-linear-gradient(top, #99c47c, #75ae4c);
      background-image: linear-gradient(to bottom, #99c47c, #75ae4c);
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:hover {
      border: 1px solid #447f19;
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:focus {
      outline: none;
      border: 1px solid #447f19;
    }

    .mktoForm .mktoButtonWrap.mktoSimple .mktoButton:active {
      background-color: #75ae4c;
      background-image: -webkit-gradient(linear, left top, left bottom, from(#75ae4c), to(#99c47c));
      background-image: -webkit-linear-gradient(top, #75ae4c, #99c47c);
      background-image: -moz-linear-gradient(top, #75ae4c, #99c47c);
      background-image: linear-gradient(to bottom, #75ae4c, #99c47c);
    }
  </style>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoSimple" style="margin-left: 120px;"><button type="submit" class="mktoButton">Submit</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="1461"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="677-THP-415">
</form>

<form style="display: none; font-family: Helvetica, Arial, sans-serif; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;" novalidate="novalidate"
  class="mktoForm mktoHasWidth mktoLayoutLeft"></form>

Text Content

The Log4Shell (CVE-2021-44228) critical vulnerability is widespread and
currently being exploited in the wild. Fix this issue as soon as possible. See
our blog for details.
About Snyk
 1. Snyk Vulnerability Database
 2. Maven
 3. xerces:xercesimpl


DENIAL OF SERVICE (DOS) AFFECTING XERCES:XERCESIMPL OPEN THIS LINK IN A NEW TAB
PACKAGE, VERSIONS [0,]



--------------------------------------------------------------------------------

7.5
high


 * ATTACK COMPLEXITY
   
   Low


 * AVAILABILITY
   
   High

See more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components
are vulnerable in your application, and suggest you quick fixes.

Test your applications


 * SNYK-ID
   
   SNYK-JAVA-XERCES-2359991


 * PUBLISHED
   
   25 Jan 2022


 * DISCLOSED
   
   25 Jan 2022


 * CREDIT
   
   Sergey Temnikov, Ziyi Luo

Report a new vulnerability Found a mistake?

INTRODUCED: 25 JAN 2022

New CVE-2022-23437 Open this link in a new tab

CWE-400 Open this link in a new tab

Share



HOW TO FIX?

A fix was pushed into the master branch but not yet published.

Sign up to Snyk for more details.


OVERVIEW

xerces:xercesImpl is a that is used for high performance, fully compliant XML
parsers in the Apache Xerces family.

Affected versions of this package are vulnerable to Denial of Service (DoS) via
the XML parser when handling specially crafted XML document payloads. When the
parser tries to parse such a document it gets stuck in an infinite loop for a
long time, which consumes resources.


DETAILS

Denial of Service (DoS) describes a family of attacks, all aimed at making a
system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching
security. Rather, they are focused on making websites and services unavailable
to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of
Service), an attack that attempts to clog network pipes to the system by
generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to
trigger such a crash or crippling of the service by using a flaw either in the
application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

 * High CPU/Memory Consumption- An attacker sending crafted requests that could
   cause the system to take a disproportionate amount of time to process. For
   example, commons-fileupload:commons-fileupload.

 * Crash - An attacker sending crafted requests that could cause the system to
   crash. For Example, npm ws package


REFERENCES

 * Apache Pony Mail
 * Fix Revision
 * MarkMail
 * Release Notes


PRODUCT

 * Snyk Open Source
 * Snyk Code
 * Snyk Container
 * Snyk Infrastructure as Code
 * Test with Github
 * Test with CLI


RESOURCES

 * Vulnerability DB
 * Documentation
 * Disclosed Vulnerabilities
 * Blog
 * FAQs


COMPANY

 * About
 * Jobs
 * Contact
 * Policies
 * Do Not Sell My Personal Information


CONTACT US

 * Support
 * Report a new vuln
 * Press Kit
 * Events


FIND US ONLINE

 * Twitter icon
 * Youtube icon
 * Facebook icon
 * Linkedin icon


TRACK OUR DEVELOPMENT

 * Github icon
 * 



© 2022 Snyk Limited

Registered in England and Wales. Company number: 09677925

Registered address: Highlands House, Basingstoke Road, Spencers Wood, Reading,
Berkshire, RG7 1NT.


Submit