New subject: [Bug 1857369] CVE-2019-17637 eclipse-webtools: XML external entity vulnerability in DTD Parser/Validator

15 Jul 2020


      https://bugzilla.redhat.com/show_bug.cgi?id=1857369
Bug ID: 1857369
           Summary: CVE-2019-17637 eclipse-webtools: XML external entity
                    vulnerability in DTD Parser/Validator
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team@redhat.com
          Reporter: psampaio@redhat.com
                CC: eclipse-sig@lists.fedoraproject.org, gerard@ryan.lt,
                    mat.booth@redhat.com
  Target Milestone: ---
    Classification: Other
In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06),
XML and DTD files referring to external entities could be exploited to send the
contents of local files to a remote server when edited or validated, even when
external entity resolution is disabled in the user preferences.
Upstream bug:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1857369] New: CVE-2019-17637 eclipse-webtools: XML external entity vulnerability in DTD Parser/Validator