<commit_before>Title: Security Advisories

## Security Advisories for Apache jUDDI

### CVEID : [CVE-2009-4267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4267)

VERSION:  3.0.0

PROBLEMTYPE: Information Disclosure

REFERENCES: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4267

DISCRIPTION: The jUDDI console doesn't escape line feeds that were passed in the numRows parameter. This affects log integrity, as this allows authenticated users to forge log records.

Severity: Moderate

Mitigation:

3.0.0 users should upgrade to jUDDI 3.0.1 or newer

Credit:

This issue was discovered by ﻿<NAME> of Red Hat Software.


### CVEID: [CVE-2015-5241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5241)<commit_msg>JUDDI-987 adding security advisory<commit_after>Title: Security Advisories

## Security Advisories for Apache jUDDI

### CVEID  [CVE-2018-1307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1307)

VERSION:  3.2 through 3.3.4

PROBLEMTYPE: XML Entity Expansion

REFERENCES: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4267

DISCRIPTION: If using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. This was fixed with https://issues.apache.org/jira/browse/JUDDI-987

Severity: Moderate

Mitigation:

Update your juddi-client dependencies to 3.3.5 or newer and/or discontinue use of the effected classes.

### CVEID : [CVE-2009-4267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4267)

VERSION:  3.0.0

PROBLEMTYPE: Information Disclosure

REFERENCES: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4267

DISCRIPTION: The jUDDI console doesn't escape line feeds that were passed in the numRows parameter. This affects log integrity, as this allows authenticated users to forge log records.

Severity: Moderate

Mitigation:

3.0.0 users should upgrade to jUDDI 3.0.1 or newer

Credit:

This issue was discovered by ﻿<NAME> of Red Hat Software.


### CVEID: [CVE-2015-5241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5241)
{'fraction_non_alphanumeric': 0.10660592255125284, 'fraction_numerical': 0.06287015945330296, 'mean_word_length': 4.645244215938304, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 9, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3925599', 'n_tokens_mistral': 891, 'n_tokens_neox': 774, 'n_words': 216}