PT-2019-19891 · Diffplug · Diffplug Spotless

Published 2019-03-15 · Updated 2021-07-02 · CVE-2019-9843

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DiffPlug Spotless versions prior to 1.20.0 (library and Maven plugin) DiffPlug Spotless versions prior to 3.20.0 (Gradle plugin)

Description The issue allows disclosure of file contents to a man-in-the-middle (MITM) attacker when a victim performs a spotlessApply operation on an untrusted XML file. This is due to the XML parser resolving external entities over both HTTP and HTTPS and not respecting the resolveExternalEntities setting.

Recommendations For versions prior to 1.20.0 (library and Maven plugin), update to version 1.20.0 or later. For versions prior to 3.20.0 (Gradle plugin), update to version 3.20.0 or later.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-9843

GHSA-7V35-QWWJ-P98G

Affected Products

Diffplug Spotless

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-9843 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9843 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v35-qwwj-p98g · Vendor Advisory
• https://github.com/diffplug/spotless/issues/358 · Note
• https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter · Note
• https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter · Note
• https://github.com/diffplug/spotless/pull/369 · Note
• https://github.com/diffplug/spotless · Note
• https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E · Note