Search for packages
Package details: pkg:maven/xerces/xercesImpl@2.12.0.sp2
purl pkg:maven/xerces/xercesImpl@2.12.0.sp2
Tags Ghost
Next non-vulnerable version 2.12.2
Latest non-vulnerable version 2.12.2
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ff7b-9g5f-aaar
Aliases:
CVE-2020-14338
GHSA-w4jq-qh47-hvjq
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.
2.12.0.sp3
Affected by 0 other vulnerabilities.
2.12.1
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2024-09-17T22:03:59.505015+00:00 GHSA Importer Affected by VCID-ff7b-9g5f-aaar https://github.com/advisories/GHSA-w4jq-qh47-hvjq 34.0.1
2024-01-03T17:38:43.983989+00:00 GHSA Importer Affected by VCID-ff7b-9g5f-aaar https://github.com/advisories/GHSA-w4jq-qh47-hvjq 34.0.0rc1