https://bugzilla.redhat.com/show_bug.cgi?id=1497955
Bug ID: 1497955
Summary: CVE-2017-12620 opennlp: XXE while loading models or
dictionaries with untrusted XML
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
When loading models or dictionaries that contain XML it is possible to perform
an XXE attack, since Apache OpenNLP is a library, this only affects
applications that load models or dictionaries from untrusted sources. The
versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache
OpenNLP are affected.
External References:
http://opennlp.apache.org/news/cve-2017-12620.html
--
You are receiving this mail because:
You are on the CC list for the bug.