PT-2022-11361 · Eclipse · Eclipse Lyo

Published 2022-07-07 · Updated 2022-07-15 · CVE-2021-41042

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 1.0.0 through 4.1.0

Description The issue arises from a TransformerFactory being initialized with defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.

Recommendations For Eclipse Lyo versions 1.0.0 through 4.1.0, consider restricting DTD loading when working with RDF/XML to prevent external DTD retrieval. As a temporary workaround, consider disabling the default TransformerFactory initialization until a patch is available.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-41042

GHSA-6296-MVGP-27HP

Affected Products

Eclipse Lyo

References · 9

• 🔥 https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/287 · Exploit
• https://osv.dev/vulnerability/CVE-2021-41042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41042 · Security Note
• https://osv.dev/vulnerability/GHSA-6296-mvgp-27hp · Vendor Advisory
• https://github.com/eclipse/lyo/releases/tag/v5.0.0 · Note
• https://github.com/eclipse/lyo/commit/a8b15b7f49ca15e55f6699749c39705d21367c6e · Note
• https://github.com/eclipse/lyo · Note
• https://t.me/cvenotify/32784 · Telegram Post
• https://t.me/cibsecurity/45795 · Telegram Post