Apache Ivy: XML External Entity vulnerability in Apache Ivy
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Ivy | 1.0.0 – 2.5.1 | — | No fix listed | CNA |
| — | org.apache.ivy:ivy (Maven) | before 2.5.2 | 2.5.2 | Patch available | GHSA-2jc4-r94c-rp7h |
- Apache Ivy VendorApache Affected 1.0.0 – 2.5.1 Fixed in — No fix listed CNA
- org.apache.ivy:ivy (Maven) Vendor— Affected before 2.5.2 Fixed in 2.5.2 Patch available GHSA-2jc4-r94c-rp7h
Remediation
- Fix · GHSA-2jc4-r94c-rp7h org.apache.ivy:ivy (Maven) Fixed in 2.5.2 Advisory →
Red Hat 4 advisories
- RHSA-2024:1027 Released 2024-02-28 · Red Hat rating ModerateMigration Toolkit for Applications security update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
- RHSA-2024:0720 Released 2024-02-07 · Red Hat rating ModerateMigration Toolkit for Runtimes security, bug fix and enhancement update
- MTR 1.2.4
- RHSA-2023:7678 Released 2023-12-06 · Red Hat rating ImportantRed Hat AMQ Streams 2.6.0 release and security update
- Red Hat AMQ Streams 2.6.0
Show 1 more Red Hat advisories
- RHSA-2023:5441 Released 2023-10-04 · Red Hat rating ModerateRed Hat Integration Camel for Spring Boot 4.0.0 release and security update
- RHINT Camel-Springboot 4.0.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:1027 |
| MTR 1.2.4 | Fixed | RHSA-2024:0720 |
| RHINT Camel-Springboot 4.0.0 | Fixed | RHSA-2023:5441 |
| Red Hat AMQ Streams 2.6.0 | Fixed | RHSA-2023:7678 |
Not affected: 10 products
- A-MQ Clients 2
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46751
- 2026-10-03 Alias added: GHSA-2jc4-r94c-rp7h
References
Advisory 4
- https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-94ABC0EE-9DC8-44F0-84AD-47ADD5340477
- https://lists.apache.org/thread/9gcz4xrsn8c7o9gb377xfzvkb8jltffr
- https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8
- https://nvd.nist.gov/vuln/detail/CVE-2022-46751
More Apache Ivy vulnerabilities
- TI-2022-17606 Apache Ivy allows creating/overwriting any file on the system CVSS 3.1CRITICAL 9.1
- TI-2022-17607 Apache Ivy allows path traversal in the presence of a malicious repository CVSS 3.1HIGH 7.5
- TI-2026-21046 Apache Ivy: PackagerResolver path traversal vulnerability CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-46751 · CVE Program
- CVE-2022-46751 · NVD
- FIRST EPSS
- GHSA-2jc4-r94c-rp7h · GitHub Advisory Database · CC BY 4.0
- CVE-2022-46751 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences