https://bugzilla.redhat.com/show_bug.cgi?id=1694857
Bug ID: 1694857 Summary: CVE-2019-9658 checkstyle: Loads external DTDs by default Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190311,reported=20190311,sour ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/ I:H/A:N,cwe=CWE-20,fedora-all/checkstyle=affected Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: dbhole@redhat.com, decathorpe@gmail.com, edewata@redhat.com, greg.hellings@gmail.com, java-sig-commits@lists.fedoraproject.org, mizdebsk@redhat.com, nsantos@redhat.com, rob.myers@gtri.gatech.edu, stewardship-sig@lists.fedoraproject.org Target Milestone: --- Classification: Other
Checkstyle before 8.18 loads external DTDs by default.
Upstream issue:
https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478
Upstream patch:
https://github.com/checkstyle/checkstyle/pull/6476
References:
https://checkstyle.org/releasenotes.html#Release_8.18
https://bugzilla.redhat.com/show_bug.cgi?id=1694857
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1694858
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created checkstyle tracking bugs for this issue:
Affects: fedora-all [bug 1694858]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1694858 [Bug 1694858] CVE-2019-9658 checkstyle: Loads external DTDs by default [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1694857
--- Comment #2 from Fedora Update System updates@fedoraproject.org --- checkstyle-8.0-4.1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1694857
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- checkstyle-8.0-4.1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1694857 Bug 1694857 depends on bug 1694858, which changed state.
Bug 1694858 Summary: CVE-2019-9658 checkstyle: Loads external DTDs by default [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1694858
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
java-sig-commits@lists.fedoraproject.org