CVE-2022-39135

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

pache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

References

Link	Resource
http://www.openwall.com/lists/oss-security/2022/11/21/3	Mailing List Mitigation Third Party Advisory
https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/11/21/3	Mailing List Mitigation Third Party Advisory
https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:calcite:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:17

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2022/11/21/3 - Mailing List, Mitigation, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2022/11/21/3 - Mailing List, Mitigation, Third Party Advisory
References	~~() https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082 - Mailing List, Vendor Advisory~~	() https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082 - Mailing List, Vendor Advisory

Information

Published : 2022-09-11 12:15

Updated : 2024-11-21 07:17

NVD link : CVE-2022-39135

Mitre link : CVE-2022-39135

CVE.ORG link : CVE-2022-39135

JSON object : View

Products Affected

calcite

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2022-39135", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-09-11T12:15:08.437", "references": [{"url": "http://www.openwall.com/lists/oss-security/2022/11/21/3", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082", "tags": ["Mailing List", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2022/11/21/3", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators."}, {"lang": "es", "value": "En Apache Calcite versiones anteriores a 1.32.0, los operadores SQL EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM y EXTRACT_VALUE no restringen las referencias de tipo XML External Entity en su configuraci\u00f3n, lo que los hace vulnerables a un potencial ataque de tipo External Entity (XXE). Por lo tanto, cualquier cliente que exponga estos operadores, normalmente usando el dialecto de Oracle (los tres primeros) o el de MySQL (el \u00faltimo), est\u00e1 afectado por esta vulnerabilidad (el alcance de la misma depender\u00e1 del usuario bajo el que es ejecutada la aplicaci\u00f3n). A partir de Apache Calcite versi\u00f3n 1.32.0, las declaraciones de tipo de documento y la resoluci\u00f3n de entidades externas XML est\u00e1n deshabilitadas en los operadores afectados"}], "lastModified": "2024-11-21T07:17:38.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:calcite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3C8837F-4602-456B-80B4-84EE5AE14E5E", "versionEndExcluding": "1.32.0", "versionStartIncluding": "1.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}