Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related to GHSA-cfmv-h8fx-85m7.
Recommended action: Upgrade to 3.30.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. Credits This vulnerability was reported by Mohamed Ouad from Doyensec.
Recommended action: Upgrade to 3.30.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Version 3.12.0 changed xml2rfc so that it would not access local files without the presence of its new --allow-local-file-access flag. This prevented XML External Entity (XXE) injection attacks with xinclude and XML entity references. It was discovered that xml2rfc does not respect --allow-local-file-access when a local file is specified as src in artwork or sourcecode elements. Furthermore, XML entity references can include any file inside the source dir and below without using the --allow-local-file-access flag. The xml2rfc <= 3.26.0 behaviour: | | xinclude | XML entity reference | artwork src= | sourcecode src= | |---|---|---|---|---| | without --allow-local-file-access flag | No filesystem access | Any file in xml2rfc templates dir and below, any file in source directory and below | Access source directory and below | Access source directory and below | | with --allow-local-file-access flag | Access any file on filesystem[^1] | Access any file on filesystem[^1] | Access source…
Recommended action: Upgrade to 3.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
xml2rfc allows script elements in SVG sources. In HTML output having these script elements can lead to XSS attacks. Sample XML snippet: Impact This vulnerability impacts website that publish HTML drafts and RFCs. Patches This has been fixed in version 3.12.4. Workarounds If SVG source is self-contained within the XML, scraping script elements from SVG files. References https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script For more information If you have any questions or comments about this advisory: Open an issue in xml2rfc Email us at operational-vulnerability@ietf.org Infrastructure and Services Vulnerability Disclosure
Recommended action: Upgrade to 3.12.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.