https://bugzilla.redhat.com/show_bug.cgi?id=1512827
Bug ID: 1512827
Summary: CVE-2017-9096 itext: External entities not disabled
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: alazarot(a)redhat.com, andjrobins(a)gmail.com,
anstephe(a)redhat.com, etirelli(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
kverlaen(a)redhat.com, lef(a)fedoraproject.org,
lpetrovi(a)redhat.com, oget.fedora(a)gmail.com,
paradhya(a)redhat.com, pavelp(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable
external entities, which might allow remote attackers to conduct XML external
entity (XXE) attacks via a crafted PDF.
External References:
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSN...
--
You are receiving this mail because:
You are on the CC list for the bug.