[GHSA-rmqp-9w4c-gc7w] Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

[claudioandreantonio]

Updates

• Affected products

Comments
Hi there.
We have this artifact being used https://mvnrepository.com/artifact/org.apache.axis/com.springsource.org.apache.axis/1.4.0, Are you able to confirm if it is also affected by the vulnerability? Thank you in advance.

[CallmeMari]

Hi @claudioandreantonio, unfortunately we cannot confirm if it has been affected by any vulnerability this way. The community contribution repository is for any supporting references or updates to existing in-scope advisories.

[claudioandreantonio]

Hi @CallmeMari . Thank you for the feedback. This CVE seems to apply to the package I mentioned, because it seems that is a repackage version of the original Axis version, so it would make sense to complement this information with these especific CPE. When this type issues occur what should be done? This would require a separate advisory?

[taladrane]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.