CVE-2021-41042

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 1.0.0 through 4.1.0

Description The issue arises from a TransformerFactory being initialized with defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.

Recommendations For Eclipse Lyo versions 1.0.0 through 4.1.0, consider restricting DTD loading when working with RDF/XML to prevent external DTD retrieval. As a temporary workaround, consider disabling the default TransformerFactory initialization until a patch is available.