https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:57:11 +0000 https://vulnerability.circl.lu/vuln/ghsa-xm28-xvqc-gxxg <p><strong>Affected:</strong> Maven: eu.copernik:copernik-xml-factory</p> <p>Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library&#39;s documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.</p> <p>An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF).</p> <p>All of the following conditions must hold for an application to be affected: - it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`; - the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath; - XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature; - it parses XML from an untrusted source.</p> <p>The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.</p> <p>Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider.</p> <p>### Acknowledgeme…</p> <p><strong>Affected:</strong> Maven: eu.copernik:copernik-xml-factory</p> <p>Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library&#39;s documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.</p> <p>An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF).</p> <p>All of the following conditions must hold for an application to be affected: - it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`; - the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath; - XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature; - it parses XML from an untrusted source.</p> <p>The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.</p> <p>Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider.</p> <p>### Acknowledgeme…</p> https://vulnerability.circl.lu/vuln/ghsa-xm28-xvqc-gxxg