GHSA-h22x-hm8g-rxpg

Source

https://github.com/advisories/GHSA-h22x-hm8g-rxpg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h22x-hm8g-rxpg/GHSA-h22x-hm8g-rxpg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h22x-hm8g-rxpg

Aliases

CVE-2017-12620

Published

2022-05-17T00:29:00Z

Modified

2023-11-08T03:58:53.308326Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Restriction of XML External Entity Reference in Apache OpenNLP

Details

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.

Database specific

{
    "nvd_published_at": "2017-10-03T01:29:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-01T20:36:40Z"
}

References

Affected packages

Maven / org.apache.opennlp:opennlp-tools

Package

Name: org.apache.opennlp:opennlp-tools; View open source insights on deps.dev
Purl: pkg:maven/org.apache.opennlp/opennlp-tools

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

1.8.2

Affected versions

1.*

1.5.1-incubating

1.5.2-incubating

1.5.3

1.6.0

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

Database specific

last_known_affected_version_range

"<= 1.8.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-h22x-hm8g-rxpg/GHSA-h22x-hm8g-rxpg.json"