medium4.2
CVE-2021-41042
XML External Entity Reference in Eclipse Lyo
Impact
In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.eclipse.lyo:lyo-parent | >= 1.0.0, <= 4.1.0 | 5.0.0.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Lyo | from 1.0.0 through 4.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/287
- https://github.com/advisories/GHSA-6296-mvgp-27hp
- https://nvd.nist.gov/vuln/detail/CVE-2021-41042
- https://github.com/eclipse/lyo/commit/a8b15b7f49ca15e55f6699749c39705d21367c6e
- https://github.com/eclipse/lyo/releases/tag/v5.0.0