CVE-2017-5644 Improper Restriction of Recursive Entity References in DTDs in Apache POI
MediumCVSS 5.5
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | < 3.15 | 3.15 |
| debian/libapache-poi-java(Debian:12) | < 3.17-1 | 3.17-1 |
| debian/libapache-poi-java(Debian:14) | < 3.17-1 | 3.17-1 |
| debian/libapache-poi-java(Debian:13) | < 3.17-1 | 3.17-1 |
| org.apache.poi/poi(Maven) | = 3.0-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10.1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.12 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.12-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.13 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.13-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.14 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | = 3.14-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.15-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.15-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.9 | No fix listed |
| apache poi | <= 3.14 | No fix listed |
| Apache POI | = before 3.15 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.oracle.com
- poi.apache.org vendor-advisory
- 96983 vdb-entry
- github.com
- Debian Security Tracker CVE-2017-5644 vendor-advisory
- bugs.debian.org issue-tracking