GHSA-pv39-qp28-4mgh

Improper Restriction of XML External Entity Reference in soa-model

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-43090

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.predic8:soa-model-parent	< 1.6.4	1.6.4
Maven	com.predic8:soa-model-core	< 1.6.4	1.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

Soa-model is a toolkit and Java API for WSDL, WADL and XML Schema. An XML External Entity (XXE) vulnerability exists in versions of soa-model prior to 1.6.4 in the WSDLParser function. This issue has been fixed in version 1.6.4.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-43090 advisory
https://github.com/membrane/soa-model/issues/281 web
https://github.com/membrane/soa-model/commit/19de16902468e7963cc4dc6b544574bc1ea3f251 web
https://github.com/membrane/soa-model/commit/3aa295f155f621d5ea661cb9a0604013fc8fd8ff web
https://github.com/membrane/soa-model package
https://github.com/membrane/soa-model/releases/tag/v1.6.4 web