What is GHSA-78vv-qj73-h9m5?

GHSA-78vv-qj73-h9m5 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Restriction of Recursive Entity References in DTDs in Apache POI

Which CVE IDs does GHSA-78vv-qj73-h9m5 cover?

GHSA-78vv-qj73-h9m5 covers the following CVE IDs: CVE-2017-5644. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-78vv-qj73-h9m5?

GHSA-78vv-qj73-h9m5 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-78vv-qj73-h9m5?

GHSA-78vv-qj73-h9m5 affects 1 product, including: maven/org.apache.poi:poi:\u003c 3.15.

GHSA-78vv-qj73-h9m5MediumCVSS 5.5

Improper Restriction of Recursive Entity References in DTDs in Apache POI

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2017-5644 →

📋 Description

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

🎯 Affected products1

maven/org.apache.poi:poi:< 3.15

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2017-5644
https://www.oracle.com/security-alerts/cpuoct2020.html
http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15
http://www.securityfocus.com/bid/96983
https://github.com/advisories/GHSA-78vv-qj73-h9m5