Markus Koschany pushed to branch master at Debian Java Maintainers / xmlgraphics-commons
Commits: 89ebbf60 by Markus Koschany at 2021-08-02T07:47:14+02:00 Fix CVE-2020-11988 - - - - - 4da3c838 by Markus Koschany at 2021-08-02T07:51:13+02:00 Update changelog and patch header - - - - - 3 changed files: - debian/changelog - + debian/patches/CVE-2020-11988.patch - + debian/patches/series Changes: ===================================== debian/changelog ===================================== @@ -1,3 +1,15 @@ +xmlgraphics-commons (2.4-2) unstable; urgency=high + + * Team upload. + * Fix CVE-2020-11988: + Apache XmlGraphics Commons is vulnerable to server-side request forgery, + caused by improper input validation by the XMPParser. By using a + specially-crafted argument, an attacker could exploit this vulnerability to + cause the underlying server to make arbitrary GET requests. + (Closes: #984949) + + -- Markus Koschany <[email protected]> Mon, 02 Aug 2021 07:48:42 +0200 + xmlgraphics-commons (2.4-1) unstable; urgency=medium * New upstream version 2.4 ===================================== debian/patches/CVE-2020-11988.patch ===================================== @@ -0,0 +1,77 @@ +From: Markus Koschany <[email protected]> +Date: Mon, 2 Aug 2021 07:47:01 +0200 +Subject: CVE-2020-11988 + +Bug-Debian: https://bugs.debian.org/984949 +Origin: https://github.com/apache/xmlgraphics-commons/commit/57393912eb87b994c7fed39ddf30fb778a275183 +--- + .../java/org/apache/xmlgraphics/xmp/XMPParser.java | 3 +++ + .../org/apache/xmlgraphics/xmp/XMPParserTestCase.java | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+) + +diff --git a/src/main/java/org/apache/xmlgraphics/xmp/XMPParser.java b/src/main/java/org/apache/xmlgraphics/xmp/XMPParser.java +index b7c0e5f..4c58a11 100644 +--- a/src/main/java/org/apache/xmlgraphics/xmp/XMPParser.java ++++ b/src/main/java/org/apache/xmlgraphics/xmp/XMPParser.java +@@ -21,6 +21,7 @@ package org.apache.xmlgraphics.xmp; + + import java.net.URL; + ++import javax.xml.XMLConstants; + import javax.xml.transform.Source; + import javax.xml.transform.Transformer; + import javax.xml.transform.TransformerException; +@@ -54,6 +55,8 @@ public final class XMPParser { + */ + public static Metadata parseXMP(Source src) throws TransformerException { + TransformerFactory tFactory = TransformerFactory.newInstance(); ++ tFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ++ tFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); + Transformer transformer = tFactory.newTransformer(); + XMPHandler handler = createXMPHandler(); + SAXResult res = new SAXResult(handler); +diff --git a/src/test/java/org/apache/xmlgraphics/xmp/XMPParserTestCase.java b/src/test/java/org/apache/xmlgraphics/xmp/XMPParserTestCase.java +index 02c4cf6..5f2ef05 100644 +--- a/src/test/java/org/apache/xmlgraphics/xmp/XMPParserTestCase.java ++++ b/src/test/java/org/apache/xmlgraphics/xmp/XMPParserTestCase.java +@@ -19,16 +19,21 @@ + + package org.apache.xmlgraphics.xmp; + ++import java.io.StringReader; + import java.net.URL; + import java.util.Calendar; + import java.util.Date; + import java.util.TimeZone; + ++import javax.xml.transform.TransformerException; ++import javax.xml.transform.stream.StreamSource; ++ + import org.junit.Test; + + import static org.junit.Assert.assertEquals; + import static org.junit.Assert.assertNotNull; + import static org.junit.Assert.assertNull; ++import static org.junit.Assert.assertTrue; + + import org.apache.xmlgraphics.xmp.schemas.DublinCoreAdapter; + import org.apache.xmlgraphics.xmp.schemas.DublinCoreSchema; +@@ -189,4 +194,18 @@ public class XMPParserTestCase { + assertNull(title); //Empty value treated same as not existant + } + ++ @Test ++ public void testExternalDTD() { ++ String payload = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" ++ + "<!DOCTYPE root [\n<!ENTITY % remote SYSTEM \"http://127.0.0.1:9999/eval.xml\";>\n%remote;]>\n" ++ + "<root></root>"; ++ StreamSource streamSource = new StreamSource(new StringReader(payload)); ++ String msg = ""; ++ try { ++ XMPParser.parseXMP(streamSource); ++ } catch (TransformerException e) { ++ msg = e.getMessage(); ++ } ++ assertTrue(msg, msg.contains("access is not allowed")); ++ } + } ===================================== debian/patches/series ===================================== @@ -0,0 +1 @@ +CVE-2020-11988.patch View it on GitLab: https://salsa.debian.org/java-team/xmlgraphics-commons/-/compare/b1b3ae5d27ebad4fa4982a6837d9dc4890a8add5...4da3c838ad990fad13086935d19a130be736e196 -- View it on GitLab: https://salsa.debian.org/java-team/xmlgraphics-commons/-/compare/b1b3ae5d27ebad4fa4982a6837d9dc4890a8add5...4da3c838ad990fad13086935d19a130be736e196 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ pkg-java-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-commits
