Source: xmlgraphics-commons Version: 2.4-1 Severity: important Tags: security upstream Forwarded: https://issues.apache.org/jira/browse/XGC-122 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for xmlgraphics-commons. CVE-2020-11988[0]: | Apache XmlGraphics Commons 2.4 is vulnerable to server-side request | forgery, caused by improper input validation by the XMPParser. By | using a specially-crafted argument, an attacker could exploit this | vulnerability to cause the underlying server to make arbitrary GET | requests. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-11988 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11988 [1] https://www.openwall.com/lists/oss-security/2021/02/24/1 [2] https://github.com/apache/xmlgraphics-commons/commit/57393912eb87b994c7fed39ddf30fb778a275183 [3] https://issues.apache.org/jira/browse/XGC-122 Please adjust the affected versions in the BTS as needed. Regards, Salvatore