XXE in Apache Spark
CVE-2019-10172
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.170 (97.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.166 · newest: 0.170 · change: +0.004
Affected products
- Apache Spark — versions 3.0.1
- Fasterxml Jackson-Mapper-Asl
- Debian Linux — versions 8.0, 9.0
- Red Hat Jackson-Mapper-Asl — versions 1.9.x
- Red Hat Jboss Enterprise Application Platform — versions 7.0
- Red Hat Jboss Fuse — versions 7.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- lists.debian.org/debian-lts-announce/2020/01/msg00037.html (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd6… (mailing-list)
- lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856c… (mailing-list)
- lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a… (mailing-list)
- lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60… (mailing-list)
- lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab… (mailing-list)
- lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb807… (mailing-list)
- lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e… (mailing-list)
- lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6… (mailing-list)
Frequently asked questions
- What is CVE-2019-10172?
- CVE-2019-10172 is a high-severity vulnerability in Apache Spark, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2019-11-18.
- How severe is CVE-2019-10172?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-10172 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.