PT-2019-19891 · Diffplug · Diffplug Spotless

Publicado 2019-03-15 · Atualizado 2021-07-02 · CVE-2019-9843

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DiffPlug Spotless versions prior to 1.20.0 (library and Maven plugin) DiffPlug Spotless versions prior to 3.20.0 (Gradle plugin)

Description The issue allows disclosure of file contents to a man-in-the-middle (MITM) attacker when a victim performs a spotlessApply operation on an untrusted XML file. This is due to the XML parser resolving external entities over both HTTP and HTTPS and not respecting the resolveExternalEntities setting.

Recommendations For versions prior to 1.20.0 (library and Maven plugin), update to version 1.20.0 or later. For versions prior to 3.20.0 (Gradle plugin), update to version 3.20.0 or later.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-9843

GHSA-7V35-QWWJ-P98G

Produtos afetados

Diffplug Spotless

Referências · 9

• https://github.com/diffplug/spotless/issues/358 · Nota
• https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter · Nota
• https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter · Nota
• https://github.com/diffplug/spotless/pull/369 · Nota
• https://github.com/diffplug/spotless · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9843 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9843 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-7v35-qwwj-p98g · Aviso do Fabricante