Security vulnerability in 2.12.0

--000000000000b1902705b199ca84
Content-Type: text/plain; charset="UTF-8"

 Hi all,

I noticed a recent discovered vulnerability in Xerces

https://nvd.nist.gov/vuln/detail/CVE-2020-14338
CVE-2020-14338 Detail
Current Description

A flaw was found in Wildfly's implementation of Xerces, specifically in the
way the XMLSchemaValidator class in the JAXP component of Wildfly enforced
the "use-grammar-pool-only" feature. This flaw allows a specially-crafted
XML file to manipulate the validation process in certain cases. This issue
is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a
similar code. All xerces jboss versions before 2.12.0.SP3.

Is there any plan to create a bugfix release to remediate this?


Thanks

Andrew

--000000000000b1902705b199ca84
Content-Type: text/html; charset="UTF-8"

<div dir="ltr">
<div>Hi all,</div><div><br></div><div>I noticed a recent discovered vulnerability in Xerces</div><div><br></div><div><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-14338" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2020-14338</a></div><div>
<h2><span>CVE-2020-14338</span>
							Detail
						</h2>
						<div>

							<div>
								
 
								
									<h3 id="gmail-m_3820772214472177129gmail-vulnDescriptionTitle">Current Description </h3>
								<p>A flaw was found in Wildfly&#39;s 
implementation of Xerces, specifically in the way the XMLSchemaValidator
 class in the JAXP component of Wildfly enforced the 
&quot;use-grammar-pool-only&quot; feature. This flaw allows a specially-crafted 
XML file to manipulate the validation process in certain cases. This 
issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and 
uses a similar code. All xerces jboss versions before 2.12.0.SP3.</p><p>Is there any plan to create a bugfix release to remediate this?</p><p><br></p><p>Thanks</p><font color="#888888"><p>Andrew<br></p></font></div></div></div>

</div>

--000000000000b1902705b199ca84--