GHSA-jvfv-hrrc-6q72

Improper Restriction of XML External Entity Reference in Liquibase

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-0839

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.liquibase:liquibase-core	< 4.8.0	4.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0839 advisory
https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381 web
https://github.com/liquibase/liquibase package
https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70 web
https://www.oracle.com/security-alerts/cpujul2022.html web
http://seclists.org/fulldisclosure/2025/Apr/14 web