{
  "cveId": "CVE-2022-28890",
  "url": "https://patchblox.com/security/cve/CVE-2022-28890",
  "summary": "CVE-2022-28890 is fixed in apache-jena on 1 platform, first by DEBIAN-CVE-2022-28890, released May 5, 2022. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "apache-jena: A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved",
  "description": "A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.",
  "published": "2022-05-05T09:15:08Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.02668,
  "epssPercentile": 0.85828,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-jena",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "4.5.0-1",
      "fix": "DEBIAN-CVE-2022-28890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-28890",
      "released": "2022-05-05T09:15:08Z"
    },
    {
      "platform": "linux",
      "product": "apache-jena",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "4.5.0-1",
      "fix": "DEBIAN-CVE-2022-28890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-28890",
      "released": "2022-05-05T09:15:08Z"
    },
    {
      "platform": "linux",
      "product": "apache-jena",
      "release": "Debian 14",
      "fixedVersion": "4.5.0-1",
      "fix": "DEBIAN-CVE-2022-28890",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-28890",
      "released": "2022-05-05T09:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}