[<prev] [next>] [day] [month] [year] [list]
Message-ID: <31ac7d5a-c4fa-44f2-21d5-139851806bb0@lehmi.de>
Date: Fri, 12 Apr 2019 06:44:41 +0200
From: Andreas Lehmkuehler <andreas@...mi.de>
To: oss-security@...ts.openwall.com
Subject: [SECURITY] CVE-2019-0228 Apache PDFBox XML External Entity
vulnerability
CVE-2019-0228: Apache PDFBox XML External Entity vulnerability
Severity: Important
Vendor:
The Apache Software Foundation
Versions Affected:
Apache PDFBox 2.0.14
Description:
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows
context-dependent attackers to conduct XML External Entity (XXE) attacks via a
crafted XFDF.
Mitigation:
Upgrade to Apache PDFBox 2.0.15
Credit:
This issue was discovered by Kurt Boberg from DocuSign
[1] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
