Medium, CVSS 5.3MavenPublished
XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
CVE-2019-10782 · GHSA-763g-fqq7-48wg
- Affected
- Maven com.puppycrawl.tools:checkstyle < 8.29
- Fixed in
- 8.29· Vendor fix available
- Issue
- Due to an incomplete fix for CVE-2019-9658, checkstyle was still vulnerable to XML External Entity (XXE) Processing. Impact User: Build Maintainers This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure. User: Static Analysis as a Service If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch. Note from the discoverer of the original CVE-2019-9658: While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags: Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent…
Recommended action: Upgrade to 8.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.