ECHO-90aa-b1f3-d3e8
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-90aa-b1f3-d3e8.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-90aa-b1f3-d3e8
- Upstream
- Withdrawn
- 2026-11-12T08:00:07Z
- Published
- 2024-12-19T18:31:37Z
- Modified
- 2026-11-12T08:20:30Z
- Summary
- Server-side request forgery through an external DTD referenced by a configuration file's DOCTYPE. Fixed on the 1.3 line in 1.3.15 (GHSA lists logback-core < 1.3.15) by commit 2863a4974: SaxEventRecorder now overrides resolveEntity() to ignore external DTDs and disables external general and parameter entities. The 1.3.15 tag contains that code, and upstream's SaxEventRecorderTest (event-ssrf.xml) runs in this spec's test block. trivy matches only the 1.5.13 fixed version.
- Details
- References