Apache Olingo
4 CVEs affecting Apache Olingo. Latest disclosed: 2020-01-09. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17556 | Critical | 9.8 | 2019-12-04 | Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserializ… |
CVE-2020-1925 | High | 7.5 | 2020-01-09 | Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE requ… |
CVE-2019-17555 | High | 7.5 | 2019-12-04 | The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any… |
CVE-2019-17554 | Medium | 5.5 | 2019-12-04 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with c… |