{
  "cveId": "CVE-2021-33813",
  "url": "https://patchblox.com/security/cve/CVE-2021-33813",
  "summary": "CVE-2021-33813 is fixed in 17 products on 1 platform, first by ALAS2023-2023-014, released February 17, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apiguardian: This update for Java fixes thefollowing issues:\n\napiguardian was updated to vesion 1.1.2:\n\n- Added LICENSE/NOTICE to...",
  "description": "This update for Java fixes thefollowing issues:\n\napiguardian was updated to vesion 1.1.2:\n\n- Added LICENSE/NOTICE to the generated jar\n- Allow @API to be declared at the package level\n- Explain usage of Status.DEPRECATED\n- Include OSGi metadata in manifest\n\nassertj-core was implemented at version 3.25.3:\n\n- New package implementation needed by Junit5\n\nbyte-buddy was updated to version v1.14.16:\n\n- \u0060byte-buddy\u0060 is required by \u0060assertj-core\u0060\n- Changes in version v1.14.16:\n\n  * Update ASM and introduce support for Java 23.\n\n- Changes in version v1.14.15:\n\n  * Allow attaching from root on J9.\n\n- Changes of v1.14.14:\n\n  * Adjust type validation to accept additional names that are\n    legal in the class file format.\n  * Fix dynamic attach on Windows when a service user is active.\n  * Avoid failure when using Android\u0027s strict mode.\n\ndom4j was updated to version 2.1.4:\n\n- Improvements and potentially breaking changes:\n\n  * Added new factory method org.dom4j.io.SAXReader.createDefault(). It has more secure defaults than new SAXReader(),\n    which uses system XMLReaderFactory.createXMLReader() or SAXParserFactory.newInstance().newSAXParser().\n  * If you use some optional dependency of dom4j (for example Jaxen, xsdlib etc.), you need to specify an explicit\n    dependency on it in your project. They are no longer marked as a mandatory transitive dependency by dom4j.\n  * Following SAX parser features are disabled by default in DocumentHelper.parse() for security reasons (they were\n    enabled in previous versions):\n      \n    \u002B http://xml.org/sax/properties/external-general-entities\n    \u002B http://xml.org/sax/properties/external-parameter-entities\n\n- Other changes:\n\n  * Do not depend on jtidy, since it is not used during build\n  * Fixed license to Plexus\n  * JPMS: Add the Automatic-Module-Name attribute to the manifest.\n  * Make a separate flavour for a minimal \u0060dom4j-bootstrap\u0060 package used to build \u0060jaxen\u0060 and full \u0060dom4j\u0060\n  * Updated pull-parser version\n  * Reuse the writeAttribute method in writeAttributes\n  * Support build on OS with non-UTF8 as default charset\n  * Gradle: add an automatic module name\n  * Use Correct License Name \u0027Plexus\u0027\n  * Possible vulnerability of DocumentHelper.parseText() to XML injection\n  * CVS directories left in the source tree\n  * XMLWriter does not escape supplementary unicode characters correctly\n  * writer.writeOpen(x) doesn\u0027t write namespaces\n  * Fixed concurrency problem with QNameCache\n  * All dependencies are optional\n  * SAXReader: hardcoded namespace features\n  * Validate QNames\n  * StringIndexOutOfBoundsException in XMLWriter.writeElementContent()\n  * TreeNode has grown some generics\n  * QName serialization fix\n  * DocumentException initialize with nested exception\n  * Accidentally occurring error in a multi-threaded test\n  * Added compatibility with W3C DOM Level 3\n  * Use Java generics\n\nhamcrest:\n\n-  \u0060hamcrest-core\u0060 has been replaced by \u0060hamcrest\u0060 (no source changes)\n\njunit had the following change:\n\n- Require hamcrest \u003E= 2.2\n\njunit5 was updated to version 5.10.2:\n    \n- Conditional execution based on OS architectures\n- Configurable cleanup mode for @TempDir\n- Configurable thread mode for @Timeout\n- Custom class loader support for class/method selectors, @MethodSource, @EnabledIf, and @DisabledIf\n- Dry-run mode for test execution\n- Failure threshold for @RepeatedTest\n- Fixed build with the latest open-test-reporting milestone\n- Fixed dependencies in module-info.java files\n- Fixed unreported exception error that is fatal with JDK 21\n- Improved configurability of parallel execution\n- New @SelectMethod support in test @Suite classes.\n- New ConsoleLauncher subcommand for test discovery without execution\n- New convenience base classes for implementing ArgumentsProvider and ArgumentConverter\n- New IterationSelector\n- New LauncherInterceptor SPI\n- New NamespacedHierarchicalStore for use in third-party test engines\n- New TempDirFactory SPI for customizing how temporary directories are created\n- New testfeed details mode for ConsoleLauncher\n- New TestInstancePreConstructCallback extension API\n- Numerous bug fixes and minor improvements\n- Parameter injection for @MethodSource methods\n- Promotion of various experimental APIs to stable\n- Reusable parameter resolution for custom extension methods via ExecutableInvoker\n- Stacktrace pruning to hide internal JUnit calls\n- The binaries are compatible with java 1.8\n- Various improvements to ConsoleLauncher\n- XML reports in new Open Test Reporting format\n\njdom:\n\n- Security issues fixed:\n\n  * CVE-2021-33813: Fixed an XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service\n    via a crafted HTTP request (bsc#1187446)\n\n- Other changes and bugs fixed:\n    \n  * Fixed wrong entries in changelog (bsc#1224410)\n  * The packages \u0060jaxen\u0060, \u0060saxpath\u0060 and \u0060xom\u0060 are now separate standalone packages instead of being part of \u0060jdom\u0060\n\njaxen was implemented at version 2.0.0:\n\n- New standalone RPM package implementation, originally part of \u0060jdom\u0060 source package\n- Classpaths are much smaller and less complex, and will suppress a lot of noise from static analysis tools.\n- The Jaxen core code is also a little smaller and has fixed a few minor bugs in XPath evaluation\n- Despite the major version bump, this should be a drop in replacement for almost every project. \n  The two major possible incompatibilities are:\n  \n  * The minimum supported Java version is now 1.5, up from 1.4 in 1.2.0 and 1.3 in 1.1.6.\n  * dom4j, XOM, and JDOM are now optional dependencies so if a project was depending on them to be loaded transitively\n    it will need to add explicit dependencies to build.\n\njopt-simple:\n\n- Included jopt-simple to Package Hub 15 SP5 (no source changes)\n\nobjectweb-asm was updated to version 9.7:\n\n- New Opcodes.V23 constant for Java 23\n- Bugs fixed\n  * Fixed unit test regression in dex2jar.\n  * Fixed \u0027ClassNode#outerClass\u0027 with incorrect JavaDocs.\n  * asm-bom packaging should be \u0027pom\u0027.\n  * The Textifier prints a supplementary space at the end of each method that throws at least one exception.\n\n\nopen-test-reporting:\n\n- Included \u0060open-test-reporting-events\u0060 and \u0060open-test-reporting-schema\u0060 to the channels as they are runtime \n  dependencies of Junit5 (no source changes)\n\nsaxpath was implemented at version 1.0 FCS:\n\n- New standalone RPM package implementation, originally part of \u0060jdom\u0060 source package (openSUSE Leap 15.5 package only)\n\nxom was implemented at version 1.3.9:\n\n- New standalone RPM package implementation, originally part of \u0060jdom\u0060 source package\n- The Nodes and Elements classes are iterable so you can use the enhanced for loop syntax on instances of these classes.\n- The copy() method is now covariant.\n- Adds Automatic-Moduole-Name to jar\n- Remove direct dependency on xml-apis:xml-apis artifact since these classes are now available in the core runtime.\n- Eliminate usage of com.sun classes to make XOM compatible with JDK 16.\n- Replace remaining usages of StringBuffer with StringBuilder to slightly improve performance.",
  "published": "2023-02-17T20:43:00Z",
  "severity": "moderate",
  "epss": 0.19442,
  "epssPercentile": 0.97384,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apiguardian",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.1.2-150200.3.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "apiguardian",
      "release": "sles 15.6",
      "fixedVersion": "1.1.2-150200.3.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "assertj-core",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.25.3-150200.5.4.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "assertj-core",
      "release": "sles 15.6",
      "fixedVersion": "3.25.3-150200.5.4.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "byte-buddy",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.14.16-150200.5.7.1",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "byte-buddy",
      "release": "sles 15.6",
      "fixedVersion": "1.14.16-150200.5.7.1",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "dom4j",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.1.4-150200.12.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "dom4j",
      "release": "sles 15.6",
      "fixedVersion": "2.1.4-150200.12.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "hamcrest",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.2-150200.12.17.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "hamcrest",
      "release": "sles 15.6",
      "fixedVersion": "2.2-150200.12.17.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jaxen",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.0.0-150200.5.3.1",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jaxen",
      "release": "sles 15.6",
      "fixedVersion": "2.0.0-150200.5.3.1",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jdom",
      "release": "amzn 2023",
      "fixedVersion": "1.1.3-30.amzn2023.0.3",
      "fix": "ALAS2023-2023-014",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-014",
      "released": "2023-02-17T20:43:00Z"
    },
    {
      "platform": "linux",
      "product": "jdom",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.1.3-150200.12.8.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jdom",
      "release": "sles 15.6",
      "fixedVersion": "1.1.3-150200.12.8.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jdom-demo",
      "release": "amzn 2023",
      "fixedVersion": "1.1.3-30.amzn2023.0.3",
      "fix": "ALAS2023-2023-014",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-014",
      "released": "2023-02-17T20:43:00Z"
    },
    {
      "platform": "linux",
      "product": "jdom-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1.1.3-30.amzn2023.0.3",
      "fix": "ALAS2023-2023-014",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-014",
      "released": "2023-02-17T20:43:00Z"
    },
    {
      "platform": "linux",
      "product": "jopt-simple",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.0.4-150200.3.4.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "jopt-simple",
      "release": "sles 15.6",
      "fixedVersion": "5.0.4-150200.3.4.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.13.2-150200.3.15.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit",
      "release": "sles 15.6",
      "fixedVersion": "4.13.2-150200.3.15.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit5",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.10.2-150200.3.10.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit5",
      "release": "sles 15.6",
      "fixedVersion": "5.10.2-150200.3.10.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit5-minimal",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.10.2-150200.3.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "junit5-minimal",
      "release": "sles 15.6",
      "fixedVersion": "5.10.2-150200.3.10.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "objectweb-asm",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "9.7-150200.3.15.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "objectweb-asm",
      "release": "sles 15.6",
      "fixedVersion": "9.7-150200.3.15.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "open-test-reporting",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.1.0~M2-150200.5.7.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "open-test-reporting",
      "release": "sles 15.6",
      "fixedVersion": "0.1.0~M2-150200.5.7.2",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "saxpath",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.0-150200.5.3.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "xom",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.3.9-150200.5.3.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    },
    {
      "platform": "linux",
      "product": "xom",
      "release": "sles 15.6",
      "fixedVersion": "1.3.9-150200.5.3.3",
      "fix": "SUSE-SU-2024:1874-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-1874-1",
      "released": "2024-05-31T03:05:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}