====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN175
_____________________________________________________________________

DATE                : 27/04/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache UIMA.

=====================================================================
http://mail-archives.us.apache.org/mod_mbox/www-announce/201804.mbox/%3Cfac969e1-6a15-186a-d49c-338c58a0b37e@apache.org%3E
_____________________________________________________________________

CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack
exposure

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
  - uimaj 2.x.x releases prior to 2.10.2
  - uimaj 3.0.0 releases prior to 3.0.0-beta
  - uima-as releases prior to 2.10.2
  - uimaFIT releases prior to 2.4.0
  - uimaDUCC releases prior to 2.2.2

Description.
The details of this vulnerability were reported to the Apache UIMA
Private mailing list.

This  vulnerability relates to an XML external entity expansion (XXE)
capability of various XML parsers. See
   https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
for more details.

UIMA as part of its configuration and operation may read XML from
various sources, which could be tainted in ways to cause inadvertent
disclosure of local files or other internal content.

Mitigation:
Users are advised to upgrade these UIMA components to the following
levels or later:
  - uimaj: 2.x.x upgrade to 2.10.2 or later
  - uimaj: 3.x.x upgrade to 3.0.0 or later
  - uima-as: upgrade to 2.10.2 or later
  - uimaFIT: upgrade to 2.4.0 or later
  - uimaDUCC: upgrade to 2.2.2 or later

Credit: Joern Kottmann

-Marshall Schor, on behalf of the UIMA Project Management Committee


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================