CVE-2017-12621 json
Improper Restriction of XML External Entity Reference in Jelly
published 2017-09-27 9 y ago modified 2026-09-10 1 mo ago also GHSA-6g33-82gc-3pw5 , EUVD-2022-2787
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.1%
- EPSS 8.1% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
Patch / fix
- maven commons-jelly:commons-jelly 1.0.1
- apache commons_jelly 1.0.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-12621 updated cvss 9.8
commons-jelly: Apache Commons Jelly connects to URL with custom doctype definitions
-
Red Hat OpenShift Container Platform 3.11 jenkins Red Hat OpenShift Container Platform 4 jenkinsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
8.13% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | commons-jelly:commons-jelly | <1.0.1 |
1.0.1 |
Affected products
- Apache Software Foundation Apache Commons Jelly
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
issues.apache.org
/jira/browse/JELLY-293
web, issue-tracking, patch, vendor-advisory
-
lists.apache.org
/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73%40%3Cdev.commons.apache.org%3E
mailing-list
-
securityfocus.com
/bid/101052
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1039444
vdb-entry, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-12621
advisory
-
github.com
/apache/commons-jelly
package
-
lists.apache.org
/thread.html/f1fc3f2c45264af44ce782d54b5908ac95f02bf7ad88bb57bfb04b73@%3Cdev.commons.apache.org%3E
web
-
web.archive.org
/web/20200227144849/http://www.securityfocus.com/bid/101052
web
-
web.archive.org
/web/20210303081618/http://www.securitytracker.com/id/1039444
web
Sources
- CVE List CVE-2017-12621
- GitHub Advisory GHSA-6g33-82gc-3pw5
- NVD CVE-2017-12621
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.