CVE catalog

CVE-2018-1000644

rdf4j: CVE-2018-1000644

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.75% · Oct 25, 2026

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrdf4jsid5.3.2-1fixed
Debianrdf4jforky5.3.2-1fixed
Debianrdf4jtrixie3.7.7+ds-1vulnerable
Debianrdf4jbookworm3.7.7+ds-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrdf4jsourcesid5.3.2-1not yet assignedNot reported[1144952]
Debianrdf4jsourceforky5.3.2-1not yet assignedNot reported[1144952]
Debianrdf4jsourcetrixie(unfixed)not yet assignedNot reported[1144952]
Debianrdf4jsourcebookworm(unfixed)not yet assignedNot reported[1144952]

[Debian bug #1144952]

Notes

[trixie] rdf4j: Minor issue [bookworm] rdf4j: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [librdf4j-java]Unknown

    Source package: [rdf4j]

    Details (2)

    • 3.7.7+ds-1 · all · bookworm

      Affected

      dsa · rdf4j · debian · bookworm; dsa · rdf4j · debian · 12

    • 3.7.7+ds-1 · all · bookworm

      Affected

      dsa · rdf4j · debian · bookworm; dsa · rdf4j · debian · 12

[Debian 13 (Trixie)]

  • [librdf4j-java]Unknown

    Source package: [rdf4j]

    Details (2)

    • 3.7.7+ds-1 · all · trixie

      Affected

      dsa · rdf4j · debian · 13

    • 3.7.7+ds-1 · all · trixie

      Affected

      dsa · rdf4j · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]