Mageia alert MGASA-2016-0175 (jackson-dataformat-xml)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0175: Updated jackson-dataformat-xml packages fix CVE-2016-3720 
Date:
    	     
 
Fri, 13 May 2016 23:55:17 +0200
Message-ID:
    	     
 
<20160513215517.A991F9F643@duvel.mageia.org>
MGASA-2016-0175 - Updated jackson-dataformat-xml packages fix CVE-2016-3720

Publication date: 13 May 2016
URL: http://advisories.mageia.org/MGASA-2016-0175.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-3720

Description:
Updated jackson-dataformat-xml packages fix security vulnerability:

It was reported that XmlMapper in jackson-dataformat-xml is vulnerable to XXE 
attack ("Improper Restriction of XML External Entity Reference") 
(CVE-2016-3720).

References:
- https://bugs.mageia.org/show_bug.cgi?id=18382
- https://bugzilla.redhat.com/show_bug.cgi?id=1328427
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3720

SRPMS:
- 5/core/jackson-dataformat-xml-2.4.3-3.1.mga5