[CVE-2020-11991] Apache Cocoon security vulnerability

[CVE-2020-11991] Apache Cocoon security vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Cocoon up to 2.1.12

Description: When using the StreamGenerator, the code parse a 
user-provided XML.

A specially crafted XML, including external system entities, could be 
used to access any file on the server system.

Mitigation:

The StreamGenerator now ignores external entities. 2.1.x users should 
upgrade to 2.1.13

Example:

With the following input :

<!--?xml version="1.0" ?--> <!DOCTYPE replace [<!ENTITY ent SYSTEM 
"file:///etc/shadow"> ]> <userInfo> <firstName>John</firstName> 
<lastName>&ent;</lastName> </userInfo> an attacker got the content of 
/etc/shadow

Credit: This issue was discovered by Nassim Asrir.


Regards,

-- 
Cédric Damioli