PT-2021-15602 · Apache+1 · Nutch+1

Martin Heyden · Published 2021-01-25 · Updated 2022-03-18 · CVE-2021-23901

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Nutch versions prior to 1.18

Description: An XML external entity (XXE) injection issue was discovered in the Nutch DmozParser. This issue allows an attacker to interfere with the application's processing of XML data, potentially enabling them to view files on the application server filesystem and interact with back-end or external systems that the application can access.

Recommendations: For versions prior to 1.18, update to Apache Nutch 1.18 to resolve the issue. As a temporary workaround, consider restricting the use of the DmozParser until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-23901

GHSA-FXHP-WRW9-3R97

SUSE-SU-2021:0323-1

SUSE-SU-2021:0448-1

Affected Products

Nutch

Suse

References · 44

• https://nvd.nist.gov/vuln/detail/CVE-2021-23901 · Security Note
• https://issues.apache.org/jira/browse/NUTCH-2841 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0323-1 · Vendor Advisory
• https://lists.apache.org/thread.html/r090321840b44cc91086c4e317bf2baffa270749dde6c1273b6567f7c%40%3Cdev.nutch.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxhp-wrw9-3r97 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0448-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23901 · Vendor Advisory
• https://github.com/apache/nutch/pull/563 · Note
• https://bugzilla.suse.com/1177031 · Note
• https://bugzilla.suse.com/1181356 · Note
• https://bugzilla.suse.com/1177336 · Note
• https://lists.apache.org/thread.html/r7ddfd680aa7ea001ca8da63bb23e3f8caa095a8b4f2261e46bade5c7%40%3Cdev.nutch.apache.org%3E · Note
• https://bugzilla.suse.com/1179087 · Note
• https://bugzilla.suse.com/1179273 · Note
• https://bugzilla.suse.com/1179872 · Note