Bug 1933816 (CVE-2020-11988)
| Summary: | CVE-2020-11988 xmlgraphics-commons: SSRF due to improper input validation by the XMPParser | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, akoufoud, akurtako, alazarot, almorale, andjrobins, anstephe, bibryam, chazlett, dbhole, drieden, ebaron, eclipse-sig, etirelli, ganandan, ggaughan, gmalinko, hbraun, ibek, janstey, java-maint, jerboaa, jjohnstn, jkang, jochrist, jstastny, jwon, krathod, kverlaen, lef, mcermak, mizdebsk, mnovotny, mprchlik, pantinor, patrickm, pjindal, rgrunber, rlandman, rrajasek, rsynek, sdaley, vkadlcik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | xmlgraphics-commons 2.6 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-06-17 15:04:09 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1933817, 1933818, 1938380, 1938381 | ||
| Bug Blocks: | 1933819 | ||
|
Description
Guilherme de Almeida Suckevicz
2021-03-01 19:07:13 UTC
Created eclipse tracking bugs for this issue: Affects: fedora-all [bug 1933818] Created xmlgraphics-commons tracking bugs for this issue: Affects: fedora-all [bug 1933817] Statement: This flaw does not affect xmlgraphics-commons as shipped with Red Hat Enterprise Linux 8. It is out of support scope for Red Hat Enterprise Linux 6 and 7. To learn more about support scope for Red Hat Enterprise Linux, please see https://access.redhat.com/support/policy/updates/errata/ . Upstream patch commit: https://github.com/apache/xmlgraphics-commons/commit/57393912eb87b994c7fed39ddf30fb778a275183 External References: https://xmlgraphics.apache.org/security.html Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Flaw summary: src/main/java/org/apache/xmlgraphics/xmp/XMPParser.java loaded external DTDs which could allow an malicious attacker to perform a server-side request forgery attack and execute arbitrary GET requests on the victim server. This could lead to compromise of data confidentiality and/or integrity. This issue has been addressed in the following products: RHPAM 7.11.0 Via RHSA-2021:2475 https://access.redhat.com/errata/RHSA-2021:2475 This issue has been addressed in the following products: RHDM 7.11.0 Via RHSA-2021:2476 https://access.redhat.com/errata/RHSA-2021:2476 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11988 This issue has been addressed in the following products: Red Hat Fuse 7.10 Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134 |