| Name | CVE-2021-33813 |
| Description | An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2696-1, DLA-2712-1, ELA-449-1, ELA-466-1 |
| Debian Bugs | 990671, 990672, 990673 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libjdom1-java (PTS) | jessie, jessie (lts) | 1.1.3-1+deb8u1 | fixed |
| stretch (security), stretch (lts), stretch | 1.1.3-1+deb9u1 | fixed |
| buster | 1.1.3-2 | vulnerable |
| bullseye | 1.1.3-2.1 | fixed |
| sid, trixie, bookworm | 1.1.3-3 | fixed |
| libjdom2-intellij-java (PTS) | buster, bullseye | 2.0.6+git20180529-2 | vulnerable |
| sid, trixie, bookworm | 2.0.6+git20180529-3 | vulnerable |
| libjdom2-java (PTS) | jessie, jessie (lts) | 2.0.6-1+deb8u1 | fixed |
| stretch (security), stretch (lts), stretch | 2.0.6-1+deb9u1 | fixed |
| buster | 2.0.6-1 | vulnerable |
| bullseye | 2.0.6-2.1 | fixed |
| sid, trixie, bookworm | 2.0.6.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - libjdom2-intellij-java <ignored> (Minor issue)
[bullseye] - libjdom2-intellij-java <no-dsa> (Minor issue)
[buster] - libjdom2-intellij-java <no-dsa> (Minor issue)
[buster] - libjdom2-java <no-dsa> (Minor issue)
[buster] - libjdom1-java <no-dsa> (Minor issue)
https://github.com/hunterhacker/jdom/pull/188
https://alephsecurity.com/vulns/aleph-2021003
Fixed by: https://github.com/hunterhacker/jdom/commit/bd3ab78370098491911d7fe9d7a43b97144a234e
Possible regression impact: https://github.com/hunterhacker/jdom/pull/188#issuecomment-872685011
Improved regression with: https://github.com/hunterhacker/jdom/commit/dd4f3c2fc7893edd914954c73eb577f925a7d361
https://github.com/hunterhacker/jdom/commit/07f316957b59d305f04c7bdb26292852bcbc2eb5