CVE-2022-0265: XML External Entity Reference in Hazelcast

March 3, 2022 (updated June 28, 2022)

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

References

github.com/advisories/GHSA-99wh-973f-779p
github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748
huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563
nvd.nist.gov/vuln/detail/CVE-2022-0265

Code Behaviors & Features

Detect and mitigate CVE-2022-0265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →