Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider

Summary

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

Timeline

1. Jul 5, 2018, 1:00 PM UTCCVE published
2. Sep 16, 2024, 10:15 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache CXF Fediz

  prior to 1.4.4

• org.apache.cxf.fediz:fediz-springMaven

  fixed in 1.4.4

• org.apache.cxf.fediz:fediz-spring2Maven

  fixed in 1.4.4

• org.apache.cxf.fediz:fediz-spring3Maven

  fixed in 1.4.4

• org.apache.cxf.fediz:fediz-jetty8Maven

  fixed in 1.4.4

• org.apache.cxf.fediz:fediz-jetty9Maven

  fixed in 1.4.4

References 11