CVE catalog
CVE-2023-40743
axis: CVE-2023-40743
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.28% · Oct 25, 2026
** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | axis | sid | 1.4-30 | fixed |
| Debian | axis | forky | 1.4-30 | fixed |
| Debian | axis | trixie | 1.4-29 | fixed |
| Debian | axis | bookworm | 1.4-28+deb12u1 | fixed |
| Ubuntu | axis | pro | 1.4-25 | vulnerable |
| Ubuntu | axis | pro | 1.4-25ubuntu0.1~esm1 | fixed |
| Ubuntu | axis | 20.04 | 1.4-28 | vulnerable |
| Ubuntu | axis | 20.04 | 1.4-28+deb10u1build0.20.04.1 | fixed |
| Ubuntu | axis | 22.04 | 1.4-28 | vulnerable |
| Ubuntu | axis | 22.04 | 1.4-28+deb10u1build0.22.04.1 | fixed |
| Ubuntu | axis | pro | 1.4-25 | vulnerable |
| Ubuntu | axis | pro | 1.4-25ubuntu0.1~esm1 | fixed |
| Ubuntu | axis | 20.04 | 1.4-28 | vulnerable |
| Ubuntu | axis | 20.04 | 1.4-28+deb10u1build0.20.04.1 | fixed |
| Ubuntu | axis | 22.04 | 1.4-28 | vulnerable |
| Ubuntu | axis | 22.04 | 1.4-28+deb10u1build0.22.04.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | axis | source | sid | 1.4-29 | not yet assigned | Not reported | [1051288] |
| Debian | axis | source | forky | 1.4-29 | not yet assigned | Not reported | [1051288] |
| Debian | axis | source | trixie | 1.4-29 | not yet assigned | Not reported | [1051288] |
| Debian | axis | source | bookworm | 1.4-28+deb12u1 | not yet assigned | Not reported | [1051288] |
| Ubuntu | axis | deb | pro | 1.4-25ubuntu0.1~esm1 | Not reported | USN-6470-1 | Not reported |
| Ubuntu | axis | deb | 20.04 | 1.4-28+deb10u1build0.20.04.1 | Not reported | USN-6470-1 | Not reported |
| Ubuntu | axis | deb | 22.04 | 1.4-28+deb10u1build0.22.04.1 | Not reported | USN-6470-1 | Not reported |
| Ubuntu | axis | deb | pro | 1.4-25ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2023-40743 | Not reported |
| Ubuntu | axis | deb | 20.04 | 1.4-28+deb10u1build0.20.04.1 | Not reported | UBUNTU-CVE-2023-40743 | Not reported |
| Ubuntu | axis | deb | 22.04 | 1.4-28+deb10u1build0.22.04.1 | Not reported | UBUNTU-CVE-2023-40743 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-40743]
- [https://osv.dev/vulnerability/DLA-3622-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-40743]
- [https://osv.dev/vulnerability/USN-6470-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-40743]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0543.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]