[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 24 Jan 2021 13:37:50 -0800
From: lewis john mcgibbney <lewismc@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-23901: An XML external entity (XXE) injection vulnerability
exists in the Nutch DmozParser
Description:
An XML external entity (XXE) injection vulnerability was discovered in the
Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external
entity injection (also known as XXE) is a web security vulnerability that
allows an attacker to interfere with an application's processing of XML
data. It often allows an attacker to view files on the application server
filesystem, and to interact with any back-end or external systems that the
application itself can access.
This issue is being tracked as NUTCH-2841
Credit:
The Apache Nutch Project Management Committee would like to thank Martin
Heyden for reporting this issue to the Apache Security Team. We are
indebted.
--
http://home.apache.org/~lewismc/
http://people.apache.org/keys/committer/lewismc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
