Bug#1041108: apache-jena: CVE-2023-32200

[Moritz Mühlenhoff]

Source: apache-jena
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for apache-jena.

CVE-2023-32200[0]:
| There is insufficient restrictions of called script functions in
| Apache Jena  versions 4.8.0 and earlier. It allows a  remote user to
| execute javascript via a SPARQL query. This issue affects Apache
| Jena: from 3.7.0 through 4.8.0.

https://www.openwall.com/lists/oss-security/2023/07/11/11


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-32200
    https://www.cve.org/CVERecord?id=CVE-2023-32200

Please adjust the affected versions in the BTS as needed.