~ / search / GHSA-6g33-82gc-3pw5

GHSA-6g33-82gc-3pw5

Improper Restriction of XML External Entity Reference in Jelly

Source: GitHub Advisory Database (reviewed) Critical CVE-2017-12621

Packages

EcosystemPackageAffectedFixed in
Maven commons-jelly:commons-jelly < 1.0.1 1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

References

External links from the advisory. They lead to third-party sites.