Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source

2019-09-06 Thread Colm O hEigeartaigh
Hi, Yes, Scott's interpretation is correct - I'm sorry if the wording of the CVE was not sufficiently clear. Let me see if there's a way to query the CVSSv3 score that was assigned to the CVE... Colm. On Fri, Sep 6, 2019 at 3:03 PM Cantor, Scott wrote: > On 9/6/19, 5:44 AM, "RvG" wrote: > >

Re: [CVE-2019-12400] Apache Santuario potentially loads XML parsing code from an untrusted source

2019-09-06 Thread RvG
Thanks Scott. I was going for a reading like this as well, but there's a little too much ambiguity in the original wording for me to feel comfortable reading it like that. I say that considering that the CVSSv3 score assigned to this vulnerability (7.5) is rather high if the bug requires you to