GHSA-6296-mvgp-27hpMediumCVSS 4.2

XML External Entity Reference in Eclipse Lyo

Published
July 8, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-41042 →

📋 Description

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.

🎯 Affected products1

  • maven/org.eclipse.lyo:lyo-parent:>= 1.0.0, <= 4.1.0

🔗 References (5)