Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 24 Jan 2021 13:37:50 -0800
From: lewis john mcgibbney <>
Subject: CVE-2021-23901: An XML external entity (XXE) injection vulnerability
 exists in the Nutch DmozParser


An XML external entity (XXE) injection vulnerability was discovered in the
Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external
entity injection (also known as XXE) is a web security vulnerability that
allows an attacker to interfere with an application's processing of XML
data. It often allows an attacker to view files on the application server
filesystem, and to interact with any back-end or external systems that the
application itself can access.

This issue is being tracked as NUTCH-2841


The Apache Nutch Project Management Committee would like to thank Martin
Heyden for reporting this issue to the Apache Security Team. We are


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.