CVE-2022-2414 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-2414 Interim 1 5 2025-11-05T01:46:46Z current 2023-10-31T00:21:30Z 2025-11-05T01:46:46Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-2414 Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 7 SUSE Liberty Linux 8 SUSE Liberty Linux 9 apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c apache-commons-net-3.6-3.module+el8.3.0+6805+72837426 bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c idm-pki-acme-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-base-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-base-java-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-ca-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-kra-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-server-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-symkey-10.12.0-4.module+el8.7.0+16126+c5918a27 idm-pki-tools-10.12.0-4.module+el8.7.0+16126+c5918a27 jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c jss-4.9.4-1.module+el8.7.0+15532+95bac9ee jss-javadoc-4.9.4-1.module+el8.7.0+15532+95bac9ee ldapjdk-4.23.0-1.module+el8.5.0+11983+6ba118b4 ldapjdk-javadoc-4.23.0-1.module+el8.5.0+11983+6ba118b4 pki-acme-11.0.6-2.el9_0 pki-base-10.5.18-24.el7_9 pki-base-11.0.6-2.el9_0 pki-base-java-10.5.18-24.el7_9 pki-base-java-11.0.6-2.el9_0 pki-ca-10.5.18-24.el7_9 pki-ca-11.0.6-2.el9_0 pki-javadoc-10.5.18-24.el7_9 pki-kra-10.5.18-24.el7_9 pki-kra-11.0.6-2.el9_0 pki-server-10.5.18-24.el7_9 pki-server-11.0.6-2.el9_0 pki-servlet-4.0-api-9.0.50-1.module+el8.7.0+15761+f86c9a56 pki-servlet-engine-9.0.50-1.module+el8.7.0+15761+f86c9a56 pki-symkey-10.5.18-24.el7_9 pki-symkey-11.0.6-2.el9_0 pki-tools-10.5.18-24.el7_9 pki-tools-11.0.6-2.el9_0 python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-idm-pki-10.12.0-4.module+el8.7.0+16126+c5918a27 python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c python3-pki-11.0.6-2.el9_0 relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c resteasy-3.0.26-6.module+el8.4.0+8891+bb8828ef slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff tomcatjss-7.7.1-1.module+el8.6.0+13291+248751b1 velocity-1.7-24.module+el8.1.0+3366+6dfb954c xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c pki-base-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-base-java-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-ca-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-javadoc-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-kra-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-server-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-symkey-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 pki-tools-10.5.18-24.el7_9 as a component of SUSE Liberty Linux 7 apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 apache-commons-net-3.6-3.module+el8.3.0+6805+72837426 as a component of SUSE Liberty Linux 8 bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 idm-pki-acme-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-base-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-base-java-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-ca-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-kra-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-server-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-symkey-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 idm-pki-tools-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 as a component of SUSE Liberty Linux 8 jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d as a component of SUSE Liberty Linux 8 jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 jss-4.9.4-1.module+el8.7.0+15532+95bac9ee as a component of SUSE Liberty Linux 8 jss-javadoc-4.9.4-1.module+el8.7.0+15532+95bac9ee as a component of SUSE Liberty Linux 8 ldapjdk-4.23.0-1.module+el8.5.0+11983+6ba118b4 as a component of SUSE Liberty Linux 8 ldapjdk-javadoc-4.23.0-1.module+el8.5.0+11983+6ba118b4 as a component of SUSE Liberty Linux 8 pki-servlet-4.0-api-9.0.50-1.module+el8.7.0+15761+f86c9a56 as a component of SUSE Liberty Linux 8 pki-servlet-engine-9.0.50-1.module+el8.7.0+15761+f86c9a56 as a component of SUSE Liberty Linux 8 python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 python3-idm-pki-10.12.0-4.module+el8.7.0+16126+c5918a27 as a component of SUSE Liberty Linux 8 python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 resteasy-3.0.26-6.module+el8.4.0+8891+bb8828ef as a component of SUSE Liberty Linux 8 slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff as a component of SUSE Liberty Linux 8 tomcatjss-7.7.1-1.module+el8.6.0+13291+248751b1 as a component of SUSE Liberty Linux 8 velocity-1.7-24.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff as a component of SUSE Liberty Linux 8 xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c as a component of SUSE Liberty Linux 8 pki-acme-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-base-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-base-java-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-ca-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-kra-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-server-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-symkey-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 pki-tools-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 python3-pki-11.0.6-2.el9_0 as a component of SUSE Liberty Linux 9 Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. CVE-2022-2414 SUSE Liberty Linux 7:pki-base-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-base-java-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-ca-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-javadoc-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-kra-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-server-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-symkey-10.5.18-24.el7_9 SUSE Liberty Linux 7:pki-tools-10.5.18-24.el7_9 SUSE Liberty Linux 8:apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:apache-commons-net-3.6-3.module+el8.3.0+6805+72837426 SUSE Liberty Linux 8:bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:idm-pki-acme-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-base-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-base-java-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-ca-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-kra-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-server-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-symkey-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:idm-pki-tools-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25 SUSE Liberty Linux 8:jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d SUSE Liberty Linux 8:jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:jss-4.9.4-1.module+el8.7.0+15532+95bac9ee SUSE Liberty Linux 8:jss-javadoc-4.9.4-1.module+el8.7.0+15532+95bac9ee SUSE Liberty Linux 8:ldapjdk-4.23.0-1.module+el8.5.0+11983+6ba118b4 SUSE Liberty Linux 8:ldapjdk-javadoc-4.23.0-1.module+el8.5.0+11983+6ba118b4 SUSE Liberty Linux 8:pki-servlet-4.0-api-9.0.50-1.module+el8.7.0+15761+f86c9a56 SUSE Liberty Linux 8:pki-servlet-engine-9.0.50-1.module+el8.7.0+15761+f86c9a56 SUSE Liberty Linux 8:python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:python3-idm-pki-10.12.0-4.module+el8.7.0+16126+c5918a27 SUSE Liberty Linux 8:python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:resteasy-3.0.26-6.module+el8.4.0+8891+bb8828ef SUSE Liberty Linux 8:slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff SUSE Liberty Linux 8:tomcatjss-7.7.1-1.module+el8.6.0+13291+248751b1 SUSE Liberty Linux 8:velocity-1.7-24.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 8:xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff SUSE Liberty Linux 8:xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c SUSE Liberty Linux 9:pki-acme-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-base-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-base-java-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-ca-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-kra-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-server-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-symkey-11.0.6-2.el9_0 SUSE Liberty Linux 9:pki-tools-11.0.6-2.el9_0 SUSE Liberty Linux 9:python3-pki-11.0.6-2.el9_0 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N