| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.geotools:gt-wfs-ng | ≥ 29.0, < 31.7≥ 32.0, < 32.3≥ 33.0, < 33.1< 28.6.1 | 31.732.333.128.6.1 |
| org.geotools:gt-xsd-core | ≥ 29.0, < 31.7≥ 32.0, < 32.3≥ 33.0, < 33.1< 28.6.1 | 31.732.333.128.6.1 |
GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.
This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).
This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.
GeoTools API change allows EntityResolver to be supplied to the following methods:
Schemas.parse( location, locators, resolvers, uriHandlers, entityResolver);
Schemas.findSchemas(Configuration configuration, EntityResolver entityResolver);
With this API change the gt-wfs-ng WFS DataStore ENTITY_RESOLVER parameter is now used.
GHSA-jj54-8f66-c5pc: Describes the impact of the gt-xsd-core vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.
GHSA-2p76-gc46-5fvc: Describes the impact of the gt-wfs-ng and gt-xsd-core vulnerability on the GeoNetwork WFS Index functionality.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン