Security Digest · Critical advisory (no CVE assigned)
GHSA-826p-4gcg-35vw: GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.
CVSS 9.9 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
mvn dependency:tree -Dincludes=<groupId>:<artifactId>. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | org.geotools:gt-xsd-core | = 33.0 | 33.1 |
| Maven | org.geotools:gt-xsd-core | >= 32.0, < 32.3 | 32.3 |
| Maven | org.geotools:gt-xsd-core | >= 29.0, <= 31.6 | 31.7 |
| Maven | org.geotools:gt-wfs-ng | >= 33.0, < 33.1 | 33.1 |
| Maven | org.geotools:gt-wfs-ng | >= 32.0, < 32.3 | 32.3 |
| Maven | org.geotools:gt-wfs-ng | >= 29.0, <= 31.6 | 31.7 |
| Maven | org.geotools:gt-xsd-core | < 28.6.1 | 28.6.1 |
| Maven | org.geotools:gt-wfs-ng | < 28.6.1 | 28.6.1 |
Details
Summary
GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.
Impact
This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).
This also impacts users of gt-wfs-ng DataStore where the ENTITYRESOLVER connection parameter was not being used as intended.
Resolution
GeoTools API change allows EntityResolver to be supplied to the following methods:
With this API change the gt-wfs-ng WFS DataStore ENTITYRESOLVER parameter is now used.
CVSS: 9.9 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Sources and references
- GitHub Advisory GHSA-826p-4gcg-35vw github.com
- github.com github.com
- github.com github.com
- github.com github.com