[ofbiz-framework] branch release18.12 updated: Fixed: [SECURITY] CVE-2022-23437: Infinite loop within Apache XercesJ xml parser (OFBIZ-12549)

[jleroux]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release18.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release18.12 by this push:
     new accec0e  Fixed: [SECURITY] CVE-2022-23437: Infinite loop within Apache 
XercesJ xml parser (OFBIZ-12549)
accec0e is described below

commit accec0efdd0edefb4c0b9621bc27e86034c32be4
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Mon Jan 31 17:11:51 2022 +0100

    Fixed: [SECURITY] CVE-2022-23437: Infinite loop within Apache XercesJ xml 
parser (OFBIZ-12549)
    
    Severity: high
    
    Description:
    
    There's a vulnerability within the Apache Xerces Java (XercesJ) XML
    parser when handling specially crafted XML document payloads. This
    causes, the XercesJ XML parser to wait in an infinite loop, which may
    sometimes consume system resources for prolonged duration. This
    vulnerability is present within XercesJ version 2.12.1 and the
    previous versions.
    
    Mitigation:
    
    Apache XercesJ users, should migrate to version 2.12.2
    
    Credit:
    
    This issue was discovered by Sergey Temnikov and Ziyi Luo, from Amazon
    Corretto/JDK Team
    
    References:
    
    https://markmail.org/message/vcmhwbuorfgcdr6l
---
 build.gradle | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build.gradle b/build.gradle
index 55789a2..b6280fd 100644
--- a/build.gradle
+++ b/build.gradle
@@ -119,7 +119,7 @@ allprojects {
             url "https://maven.restlet.talend.com";
         }
         maven {
-            // apache-xerces:xercesImpl:2.9.1
+            // apache-xerces:xercesImpl:2.12.2
             url "https://maven.repository.redhat.com/ga/";
         }
         maven {
@@ -160,7 +160,7 @@ configurations {
 
 dependencies {
     // ofbiz compile libs
-    compile 'apache-xerces:xercesImpl:2.9.1'
+    compile 'apache-xerces:xercesImpl:2.12.2'
     compile 'com.google.zxing:core:3.3.3'
     compile 
'com.googlecode.concurrentlinkedhashmap:concurrentlinkedhashmap-lru:1.4.2'
     compile 'com.googlecode.ez-vcard:ez-vcard:0.9.10'