Infinite loop in Xerces2 Java XML Parser - CVE-2022-23437

Vulnerability identifier: #VU59965

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23437

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing XML documents. A remote attacker can supply a specially crafted XML document, consume all available system resources and cause denial of service conditions.

Xerces2 Java XML Parser
Oracle Agile PLM Framework
Jazz Foundation
IBM Business Automation Workflow
Log Analysis
IBM Cloud Pak for Multicloud Management Monitoring
Oracle Banking Party Management
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Product Lifecycle Analytics
App Connect Enterprise Certified Container
IBM Sterling Control Center
Oracle Communications Design Studio
Oracle Communications Unified Inventory Management
Oracle Financial Services Enterprise Case Management
Oracle Financial Services Behavior Detection Platform
Oracle Global Lifecycle Management OPatch
Oracle Communications LSMS
IBM SPSS Modeler
IBM Sterling External Authentication Server
IBM Sterling Secure Proxy
Atlas eDiscovery Process Management
IBM Sterling B2B Integrator
Tivoli Composite Application Manager for Transactions
IBM Cloud Application Performance Management (APM)
Oracle Communications Session Report Manager
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Watson Machine Learning Accelerator
Tivoli Network Manager IP Edition
RecoverPoint Classic
Oracle iLearning
Oracle Agile Engineering Data Management
Oracle Transportation Management
Oracle Communications ASAP
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
IBM Security Verify Directory
Oracle FLEXCUBE Universal Banking
Oracle Application Testing Suite
Oracle Retail Returns Management
Oracle Retail Central Office
Oracle Retail Back Office
Oracle Retail Service Backbone
Oracle Retail Xstore Point of Service
Engineering Test Management
IBM Engineering Lifecycle Optimization - Publishing
IBM Engineering Systems Design Rhapsody
IBM Engineering Requirements Management DOORS Next
Call Center for Commerce
Oracle Financial Services Revenue Management and Billing
Oracle WebCenter Portal
Oracle Health Sciences Information Manager
IBM Content Navigator
Solaris Cluster
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openEuler
Oracle Communications MetaSolv Solution
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Oracle Communications Order and Service Management
RSA Authentication Manager
JBoss Enterprise Application Platform
Oracle WebLogic Server
Primavera Gateway
Oracle Financial Services Crime and Compliance Management Studio
Oracle Business Process Management Suite
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Retail Bulk Data Integration
Oracle Communications Element Manager
Oracle Communications Session Route Manager
SecurID Authentication Manager
PeopleSoft Enterprise PeopleTools
Oracle Documaker
Operational Decision Manager
JD Edwards EnterpriseOne Orchestrator
JD Edwards EnterpriseOne Tools
Primavera Unifier
IBM Spectrum Protect Backup-Archive Client
Oracle Commerce Guided Search
Oracle Commerce Platform
Oracle Retail Extract Transform and Load
Oracle Retail Point of Service
Oracle Retail Financial Integration
Oracle Retail Fiscal Management
Oracle Retail Merchandising System
Oracle Retail Integration Bus
xerces-j2
xerces-j2-xml-resolver
xerces-j2-xml-apis
xerces-j2-scripts
xerces-j2-demo
xerces-j2-help
IBM TRIRIGA Application Platform
IBM Case Manager
Jazz Reporting Service
IBM Qradar SIEM
IBM Spectrum Protect for Space Management
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V

Install updates from vendor's website.

Xerces2 Java XML Parser - update to 2.12.2
Log Analysis - addressed in versions 1.3.7 FP2, 1.3.7.2 IF001
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
IBM Content Navigator - addressed in versions 3.0.15 IF009, 3.1.0 IF008, 3.2.0 IF004
Tivoli Network Manager IP Edition - update to 4.2.0.20
RecoverPoint Classic - update to 5.1 SP4 P4
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
JBoss Enterprise Application Platform - update to 7.4.5
IBM Business Automation Manager Open Editions - update to 8.0.1
SecurID Authentication Manager - update to 8.6 Patch 3
JD Edwards EnterpriseOne Orchestrator - update to 9.2.6.3
JD Edwards EnterpriseOne Tools - update to 9.2.6.4
IBM Security Verify Directory - update to 11.0.0.1
Oracle Global Lifecycle Management OPatch - update to 12.2.0.1.30
Oracle Global Lifecycle Management NextGen OUI Framework - update to 13.9.4.2.10
xerces-j2 - addressed in versions 2.8.1-238.29.8.1, 2.8.1-268.9.1, 2.11.0-4.3.1, 2.12.0-3.3.1
xerces-j2-xml-resolver - addressed in versions 2.8.1-238.29.8.1, 2.8.1-268.9.1, 2.11.0-4.3.1
xerces-j2-xml-apis - addressed in versions 2.8.1-238.29.8.1, 2.8.1-268.9.1, 2.11.0-4.3.1
xerces-j2-scripts - update to 2.8.1-268.9.1
xerces-j2-demo - update to 2.8.1-268.9.1
xerces-j2 - update to 2.12.2-1
xerces-j2-help - update to 2.12.2-1
IBM TRIRIGA Application Platform - update to 4.5
IBM Case Manager - update to 5.3.3-IF011
IBM Sterling External Authentication Server - update to 6.0.3.0 iFix 06
IBM Sterling Secure Proxy - update to 6.0.3 iFix 06
Atlas eDiscovery Process Management - update to 6.0.3.9.7
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
Engineering Test Management - addressed in versions 7.0.1.0.23, 7.0.2.0.25
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Jazz Reporting Service - update to 7.0.2 iFix022
Jazz Foundation - update to 7.0.2.0.27
Tivoli Composite Application Manager for Transactions - update to 7.4.0.2.22
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
IBM Cloud Application Performance Management (APM) - addressed in versions 8.1.4.0.14, 8.1.4.0.16
IBM Spectrum Protect for Space Management - update to 8.1.15.2
IBM Spectrum Protect Backup-Archive Client - update to 8.1.15.2
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware - update to 8.1.15.2
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.15.2
RSA Authentication Manager - update to 8.7 Patch 2
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 36, 8.11.0.1 Interim fix 17, 8.11.0.1 Interim fix 18, 8.11.1 Interim fix 7
Oracle Communications Session Report Manager - update to 9.0
Oracle Communications Element Manager - update to 9.0
Oracle Communications Session Route Manager - update to 9.0
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM Security Verify Governance - update to 10.0.2
Call Center for Commerce - update to 10.0.2403.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.28, 23.0.1.6

• https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl
• http://www.openwall.com/lists/oss-security/2022/01/24/3

• Denial of service in Apache Xerces Java
• Infinite loop in Oracle iLearning
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Financial Services Enterprise Case Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle WebLogic Server
• Infinite loop in Oracle Retail Extract Transform and Load
• Multiple vulnerabilities in Oracle Retail Service Backbone
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in Oracle Retail Integration Bus
• Multiple vulnerabilities in Oracle Retail Financial Integration
• Multiple vulnerabilities in Oracle Retail Bulk Data Integration
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Denial of service in IBM Sterling Control Center
• Infinite loop in IBM Cloud Pak for Multicloud Management Monitoring
• Infinite loop in Oracle Global Lifecycle Management OPatch
• Infinite loop in Oracle Communications ASAP
• Multiple vulnerabilities in Primavera Gateway
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in Oracle Health Sciences Information Manager
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Product Lifecycle Analytics
• Multiple vulnerabilities in Oracle Agile PLM Framework
• Multiple vulnerabilities in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Communications MetaSolv Solution
• Multiple vulnerabilities in Oracle Communications Order and Service Management
• Multiple vulnerabilities in Solaris Cluster
• Multiple vulnerabilities in Oracle Transportation Management
• Multiple vulnerabilities in Oracle Retail Returns Management
• Infinite loop in Oracle Retail Point of Service
• Multiple vulnerabilities in Oracle Retail Central Office
• Multiple vulnerabilities in Oracle Retail Back Office
• Multiple vulnerabilities in Oracle Retail Fiscal Management
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Denial of service in IBM Operations Analytics - Log Analysis
• Infinite loop in Oracle Documaker
• Infinite loop in IBM Sterling External Authentication Server
• SUSE update for xerces-j2
• SUSE update for xerces-j2
• SUSE update for xerces-j2
• SUSE update for xerces-j2
• Multiple vulnerabilities in Oracle Financial Services Revenue Management and Billing
• Multiple vulnerabilities in Oracle Application Testing Suite
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle iLearning
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Dell RecoverPoint Classic
• Infinite loop in Oracle Communications Design Studio
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Infinite loop in IBM TRIRIGA Application Platform
• Infinite loop in IBM Engineering Test Management (ETM)
• Infinite loop in IBM Engineering Lifecycle Optimization - Publishing
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Business Automation Workflow and IBM Case Manager
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• IBM Sterling Secure Proxy in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Tivoli Composite Application Manager (ITCAM) for Transactions
• Multiple vulnerabilities in IBM Operational Decision Manager
• openEuler update for xerces-j2
• Multiple vulnerabilities in IBM Call Center for Commerce
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Jazz Foundation
• Multiple vulnerabilities in Atlas eDiscovery Process Management
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM Application Performance Management
• Infinite loop in Oracle Communications LSMS
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM)
• SecurID Authentication Manager update for third-party components
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM Content Navigator
• Multiple vulnerabilities in IBM SPSS Modeler
• Multiple vulnerabilities in IBM Security Verify Directory