https://bugzilla.redhat.com/show_bug.cgi?id=1527789
Bug ID: 1527789 Summary: translate-toolkit: Maliciously crafted .XLF files can result arbitrary file read and potential code exection Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: sfowler@redhat.com CC: dwayne@translate.org.za, i18n-bugs@lists.fedoraproject.org, mfabian@redhat.com, mmraka@redhat.com, petersen@redhat.com
translate-toolkit before version 2.2.0 is vulnerable to XML External Entity Execution. An attacker could exploit this by supplying a maliciously crafted .XLF file causing an arbitrary file read or potential arbitrary code execution.
References: https://bugzilla.novell.com/show_bug.cgi?id=1073535 https://github.com/translate/translate/pull/3632/files https://hackerone.com/reports/232614
https://bugzilla.redhat.com/show_bug.cgi?id=1527789
Sam Fowler sfowler@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1527790
--- Comment #1 from Sam Fowler sfowler@redhat.com --- Created translate-toolkit tracking bugs for this issue:
Affects: epel-all [bug 1527790]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1527790 [Bug 1527790] translate-toolkit: Maliciously crafted .XLF files can result arbitrary file read and potential code exection [epel-all]
i18n-bugs@lists.fedoraproject.org