Bug 772929 – <dev-java/xmlgraphics-commons-2.6: SSRF vulnerability (CVE-2020-11988)

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2021-02-25 19:22:46 UTC]

CVE-2020-11988:

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.


Please bump.

[Comment 1 Volkmar W. Pogatzki 2021-06-16 11:08:35 UTC]

Forgot to mention this bug
https://gitweb.gentoo.org/repo/gentoo.git/commit/dev-java/xmlgraphics-commons?id=2fa64ba45e00e389bbf7005578ad7ff3a8f50151

[Comment 2 Miroslav Šulc 2021-06-16 13:02:28 UTC]

the tests are passing and the consumers compile fine against this version so imo can be stabilized.

[Comment 3 John Helmert III 2021-06-16 19:30:22 UTC]

Thanks!

[Comment 4 Sam James 2021-06-17 00:12:58 UTC]

x86 done

[Comment 5 Sam James 2021-06-17 00:14:47 UTC]

amd64 done

[Comment 6 Agostino Sarubbo 2021-06-18 06:29:00 UTC]

ppc64 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 7 Larry the Git Cow 2021-06-18 06:37:23 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dfb3c9a6963b80d6c218462b859ac80ece3c3b1e

commit dfb3c9a6963b80d6c218462b859ac80ece3c3b1e
Author:     Miroslav Šulc <[e-mail]>
AuthorDate: 2021-06-18 06:37:11 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2021-06-18 06:37:11 +0000

    dev-java/xmlgraphics-commons: removed vulnerable 2.0.1
    
    Bug: https://bugs.gentoo.org/772929
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-java/xmlgraphics-commons/Manifest              |  1 -
 .../xmlgraphics-commons-2.0.1.ebuild               | 63 ----------------------
 2 files changed, 64 deletions(-)

[Comment 8 Miroslav Šulc 2021-06-18 06:37:49 UTC]

the tree is clean now, you can proceed.

[Comment 9 John Helmert III 2021-06-18 13:52:29 UTC]

Thank you!

[addCollapseLink(10, 1, 'Toggle comment display'); Comment 10 NATTkA bot 2022-02-25 21:45:03 UTC Comment hidden (obsolete)]

Keywords are not fully specified and arches are not CC-ed for the following packages:

- =dev-java/xmlgraphics-commons-2.6

[Comment 11 Larry the Git Cow 2022-02-26 08:44:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a3dd94d7603f38c077b0de0e219e64b92153b6c9

commit a3dd94d7603f38c077b0de0e219e64b92153b6c9
Author:     Volkmar W. Pogatzki <[e-mail]>
AuthorDate: 2022-02-26 07:07:33 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2022-02-26 08:43:57 +0000

    dev-java/xmlgraphics-commons: Drop 2.6
    
    Bug: https://bugs.gentoo.org/772929
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/24353
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-java/xmlgraphics-commons/Manifest              |  1 -
 .../xmlgraphics-commons-2.6.ebuild                 | 75 ----------------------
 2 files changed, 76 deletions(-)

[Comment 12 NATTkA bot 2022-02-26 08:48:57 UTC]

Unable to check for sanity:

> no match for package: dev-java/xmlgraphics-commons-2.6