Hi,

The following vulnerability was published for axis.

CVE-2019-0227[0]:
| A Server Side Request Forgery (SSRF) vulnerability affected the Apache
| Axis 1.4 distribution that was last released in 2006. Security and bug
| commits commits continue in the projects Axis 1.x Subversion
| repository, legacy users are encouraged to build from source. The
| successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not
| vulnerable to this issue.

The vulnerable 'StockQuoteService.jws' is not present in Debian binary
packages, however a SSRF mitigation was also committed [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-0227
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0227
[1] https://github.com/apache/axis1-java/commit/35511b872a6460129cfc0cd35baaccbd820977b5

Cheers!
Sylvain Beucler
Debian LTS Team

Hi,

I believe the SSRF mitigation should be viewed in the context of the
vulnerable StockQuoteService.jws file. Since we don't ship this file in
our binary packages, I think it is correct to mark the issue as
unimportant. However I agree it is sensible to change
uconn.setInstanceFollowRedirects(true) to
uconn.setInstanceFollowRedirects(false).

I don't think it is likely that this issue is somehow exploited when
using our Debian package. We use axis mainly as a build-dependency for
other packages. We could change the default for
uconn.setInstanceFollowRedirects in Buster but keep it this way in
Jessie and Stretch.

It is nice to know that there is ongoing work on axis1. I think we could
update this package after the freeze and track the new upstream
development at

https://github.com/apache/axis1-java/

Regards,

Markus

Hi!

AFAIU the vulnerable StockQuoteService.jws is fixed by its removal,
and similar XMLUtils-based services need the mitigation.
In either case the root SSRF issue is not fixed.

I trust your judgement on this.

The canonical repo is at
https://svn.apache.org/viewvc/axis/axis1/java/trunk/
(it would be good it Apache updated their SVN page..)

Cheers!
Sylvain

Hello,

Bug #929266 in axis reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/axis/-/commit/ec1fe91fe5ab879815ab9cc63ba2fbf64d86d76a

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/929266

We believe that the bug you reported is fixed in the latest version of
axis, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 929266@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated axis package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 11:15:15 +0200
Source: axis
Architecture: source
Version: 1.4-30
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 929266 1060169 1139094
Changes:
 axis (1.4-30) unstable; urgency=medium
 .
   * Depend on libservlet-api-java instead of libservlet3.1-java
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Removed Torsten Werner from the Uploaders (Closes: #1139094)
   * Fixed CVE-2019-0227: XMLUtils followed the HTTP redirections when
     fetching a resource by URL, enabling server side request forgery
     (Closes: #929266)
   * Fixed CVE-2023-51441: ServiceFactory accepted the IIOP and CORBANAME
     JNDI names, enabling server side request forgery from the admin
     service (Closes: #1060169)
   * Converted debian/watch to the version 5 format
   * Removed the libaxis-java-doc package
   * Fixed the instantiation of arbitrary classes named by the
     exceptionName of a SOAP fault, enabling unauthenticated remote code
     execution with a suitable gadget on the classpath
Checksums-Sha1:
 b908f0a7f5b44df507fecba9500664266ca8dae0 2123 axis_1.4-30.dsc
 ee43cb5df2580c6735d8f0e2bb7ad2146263106a 16788 axis_1.4-30.debian.tar.xz
 a412ffd68594f92f920c48f7c60ba4d32cc53435 11948 axis_1.4-30_source.buildinfo
Checksums-Sha256:
 5466adcaa16f8a43b538d2a2a14348b3d1040ac43f45d8e1c4a571c844a3c581 2123 axis_1.4-30.dsc
 06747994b07bcb4e6f879a9f92de22e2d7e8114f9067bb555d8b57da7cb40d0f 16788 axis_1.4-30.debian.tar.xz
 9470aef64fde7758201b0f5c8d870d4a5dde04b71ac1f86c0645bf2129058a4c 11948 axis_1.4-30_source.buildinfo
Files:
 19aeffe2c62858cb4e01b9c0170c3ebd 2123 java optional axis_1.4-30.dsc
 bf2dfd4aba76fdb73abfb06a68ee4dab 16788 java optional axis_1.4-30.debian.tar.xz
 8e5740e79c7193df42dc5018fa1a4ed5 11948 java optional axis_1.4-30_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrXNqsSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsIYEP/2HAjgbvz28+urGfIiCqKNTRaxKApnf+
LAbWDQMzv/KK5YUfZTucVGvhoqEuw1Iyk8BrTgeIyTDDf2cqMUxvZqoBnn96ghCO
Io79kkXk0d2BYptQ94TBtTUfUgCa9GCFXc0mB5YfUR9zszgMH02zznt8yZIGkDIg
kMcDDLrj7MeDunO69iJsHOCxcksX9yUdAEztGb1LGRVCK15IwQdVAUuqNlUGayld
i2qul6xcFbe2DOALHBAz5yO4Y79xpVE7Nw/vN0Ztdj9zXZ4u66Y1HEqrG1b1JV3g
jKqII1bp3zyus71y+r8UWIqNc3m298tft6wG7RuTM1U1Q8hhb/AUpZbGNyBk1jLZ
YQZMEt8YRniPhfFQ2CGiohXIYdneIJPqiGvqk4m82Vxj5M+WBb9RGvmhhuAAeqLU
viKWdEj9OnzS7yqiW05q1MDoBkfKB/LcrydDdcE0huTU4WsuZxqUa2FI/QI9HCH8
mirFsOmiJ5uPlsw/eTd8Cv5R08MN3EbDkA8axK6TjPLXc9mtnz3S25rbMgyKaS/r
b9f8W37zuvaknjvWyhAUpjYGFm58j+x1RdSHx+G0muxYc3lm8Z49avTmO4pq1+vw
wEij99vxcElFvEovAHZKmYi3Drbq0YEcMsS8QJV8YJZaj39j2ULWsCTlMs5nCs0e
JTM7MQzELr7t
=tpbP
-----END PGP SIGNATURE-----