Bug 1857369 (CVE-2019-17637) - CVE-2019-17637 eclipse-webtools: XML external entity vulnerability in DTD Parser/Validator
Summary: CVE-2019-17637 eclipse-webtools: XML external entity vulnerability in DTD Par...
Keywords:
Status: NEW
Alias: CVE-2019-17637
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1857370
Blocks: 1857371
TreeView+ depends on / blocked
 
Reported: 2020-07-15 17:53 UTC by Pedro Sampaio
Modified: 2023-07-07 08:34 UTC (History)
2 users (show)

Fixed In Version: eclipse web tools platform 3.19
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2020-07-15 17:53:40 UTC 
In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.

Upstream bug:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
Comment 1 Pedro Sampaio 2020-07-15 17:54:16 UTC 
Created eclipse-webtools tracking bugs for this issue:

Affects: fedora-all [bug 1857370]
Comment 3 Stefan Cornelius 2020-08-13 14:36:37 UTC 
Patch:
https://git.eclipse.org/c/sourceediting/webtools.sourceediting.git/commit/?id=9644d4217cd6e3be367d654a8320104d88ddfd6b
Note You need to log in before you can comment on or make changes to this bug.