Bug 720728

Summary:	dev-java/dom4j: External entity vulnerability (CVE-2020-10683)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor	CC:	java
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [ebuild cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2020-05-02 21:37:25 UTC

CVE-2020-10683 (https://nvd.nist.gov/vuln/detail/CVE-2020-10683):
  dom4j before 2.1.3 allows external DTDs and External Entities by default,
  which might enable XXE attacks. However, there is popular external
  documentation from OWASP showing how to enable the safe, non-default
  behavior in any application that uses dom4j.

Comment 1 Sam James archtester

2020-07-27 16:56:59 UTC


*** This bug has been marked as a duplicate of bug 719318 ***