Security update for dom4j SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1382-1 Final 1 1 2020-05-22T06:01:27Z current 2020-05-22T06:01:27Z 2020-05-22T06:01:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dom4j This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1382,SUSE-SUSE-Manager-Server-3.2-2020-1382 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201382-1/ Link for SUSE-SU-2020:1382-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006849.html E-Mail link for SUSE-SU-2020:1382-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1169760 SUSE Bug 1169760 https://www.suse.com/security/cve/CVE-2020-10683/ SUSE CVE CVE-2020-10683 page SUSE Manager Server 3.2 dom4j-1.6.1-27.7.2 dom4j-demo-1.6.1-27.7.2 dom4j-javadoc-1.6.1-27.7.2 dom4j-manual-1.6.1-27.7.2 dom4j-1.6.1-27.7.2 as a component of SUSE Manager Server 3.2 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. CVE-2020-10683 SUSE Manager Server 3.2:dom4j-1.6.1-27.7.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201382-1/ https://www.suse.com/security/cve/CVE-2020-10683.html CVE-2020-10683 https://bugzilla.suse.com/1169760 SUSE Bug 1169760