xstream: enabled processing of external entities
| Package(s): | xstream | CVE #(s): | CVE-2016-3674 | ||||||||||||||||||||
| Created: | April 27, 2016 | Updated: | June 8, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
XStream (x-stream.github.io) is a Java library to marshal Java objects into XML and back. For this purpose it supports a lot of different XML parsers. Some of those can also process external entities which was enabled by default. An attacker could therefore provide manipulated XML as input to access data on the file system, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||