Hi,

The following vulnerability was published for axis.

CVE-2023-51441[0]:
| ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation
| vulnerability in Apache Axis allowed users with access to the admin
| service to perform possible SSRF This issue affects Apache Axis:
| through 1.3.  As Axis 1 has been EOL we recommend you migrate to a
| different SOAP engine, such as Apache Axis 2/Java. Alternatively you
| could use a build of Axis with the patch from
| https://github.com/apache/axis-
| axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06  applied.
| The Apache Axis project does not expect to create an Axis 1.x
| release  fixing this problem, though contributors that would like to
| work towards  this are welcome.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-51441
https://www.cve.org/CVERecord?id=CVE-2023-51441
[1] https://www.openwall.com/lists/oss-security/2024/01/05/2
[2] https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06

Regards,
Salvatore

Hello,

Bug #1060169 in axis reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/axis/-/commit/481ee5f1d67c534cdbf7bdbae16fe18c37265901

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1060169

We believe that the bug you reported is fixed in the latest version of
axis, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1060169@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated axis package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 11:15:15 +0200
Source: axis
Architecture: source
Version: 1.4-30
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 929266 1060169 1139094
Changes:
 axis (1.4-30) unstable; urgency=medium
 .
   * Depend on libservlet-api-java instead of libservlet3.1-java
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Removed Torsten Werner from the Uploaders (Closes: #1139094)
   * Fixed CVE-2019-0227: XMLUtils followed the HTTP redirections when
     fetching a resource by URL, enabling server side request forgery
     (Closes: #929266)
   * Fixed CVE-2023-51441: ServiceFactory accepted the IIOP and CORBANAME
     JNDI names, enabling server side request forgery from the admin
     service (Closes: #1060169)
   * Converted debian/watch to the version 5 format
   * Removed the libaxis-java-doc package
   * Fixed the instantiation of arbitrary classes named by the
     exceptionName of a SOAP fault, enabling unauthenticated remote code
     execution with a suitable gadget on the classpath
Checksums-Sha1:
 b908f0a7f5b44df507fecba9500664266ca8dae0 2123 axis_1.4-30.dsc
 ee43cb5df2580c6735d8f0e2bb7ad2146263106a 16788 axis_1.4-30.debian.tar.xz
 a412ffd68594f92f920c48f7c60ba4d32cc53435 11948 axis_1.4-30_source.buildinfo
Checksums-Sha256:
 5466adcaa16f8a43b538d2a2a14348b3d1040ac43f45d8e1c4a571c844a3c581 2123 axis_1.4-30.dsc
 06747994b07bcb4e6f879a9f92de22e2d7e8114f9067bb555d8b57da7cb40d0f 16788 axis_1.4-30.debian.tar.xz
 9470aef64fde7758201b0f5c8d870d4a5dde04b71ac1f86c0645bf2129058a4c 11948 axis_1.4-30_source.buildinfo
Files:
 19aeffe2c62858cb4e01b9c0170c3ebd 2123 java optional axis_1.4-30.dsc
 bf2dfd4aba76fdb73abfb06a68ee4dab 16788 java optional axis_1.4-30.debian.tar.xz
 8e5740e79c7193df42dc5018fa1a4ed5 11948 java optional axis_1.4-30_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrXNqsSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsIYEP/2HAjgbvz28+urGfIiCqKNTRaxKApnf+
LAbWDQMzv/KK5YUfZTucVGvhoqEuw1Iyk8BrTgeIyTDDf2cqMUxvZqoBnn96ghCO
Io79kkXk0d2BYptQ94TBtTUfUgCa9GCFXc0mB5YfUR9zszgMH02zznt8yZIGkDIg
kMcDDLrj7MeDunO69iJsHOCxcksX9yUdAEztGb1LGRVCK15IwQdVAUuqNlUGayld
i2qul6xcFbe2DOALHBAz5yO4Y79xpVE7Nw/vN0Ztdj9zXZ4u66Y1HEqrG1b1JV3g
jKqII1bp3zyus71y+r8UWIqNc3m298tft6wG7RuTM1U1Q8hhb/AUpZbGNyBk1jLZ
YQZMEt8YRniPhfFQ2CGiohXIYdneIJPqiGvqk4m82Vxj5M+WBb9RGvmhhuAAeqLU
viKWdEj9OnzS7yqiW05q1MDoBkfKB/LcrydDdcE0huTU4WsuZxqUa2FI/QI9HCH8
mirFsOmiJ5uPlsw/eTd8Cv5R08MN3EbDkA8axK6TjPLXc9mtnz3S25rbMgyKaS/r
b9f8W37zuvaknjvWyhAUpjYGFm58j+x1RdSHx+G0muxYc3lm8Z49avTmO4pq1+vw
wEij99vxcElFvEovAHZKmYi3Drbq0YEcMsS8QJV8YJZaj39j2ULWsCTlMs5nCs0e
JTM7MQzELr7t
=tpbP
-----END PGP SIGNATURE-----