PT-2022-11361
CVE-2021-41042
·
تاريخ النشر
2022-07-07
·
تاريخ التحديث
2022-07-15
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Eclipse Lyo versions 1.0.0 through 4.1.0
Description
The issue arises from a TransformerFactory being initialized with defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
Recommendations
For Eclipse Lyo versions 1.0.0 through 4.1.0, consider restricting DTD loading when working with RDF/XML to prevent external DTD retrieval. As a temporary workaround, consider disabling the default TransformerFactory initialization until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾