Security update for dom4j SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1383-1 Final 1 1 2020-05-22T06:01:45Z current 2020-05-22T06:01:45Z 2020-05-22T06:01:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dom4j This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2020-1383,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2020-1383,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2020-1383,SUSE-2020-1383,SUSE-SLE-Module-SUSE-Manager-Server-4.0-2020-1383 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201383-1/ Link for SUSE-SU-2020:1383-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006848.html E-Mail link for SUSE-SU-2020:1383-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1169760 SUSE Bug 1169760 https://www.suse.com/security/cve/CVE-2020-10683/ SUSE CVE CVE-2020-10683 page Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server SUSE Manager Server Module 4.0 dom4j-1.6.1-4.9.4 dom4j-demo-1.6.1-4.9.4 dom4j-javadoc-1.6.1-4.9.4 dom4j-manual-1.6.1-4.9.4 dom4j-1.6.1-4.9.4 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server dom4j-1.6.1-4.9.4 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server dom4j-1.6.1-4.9.4 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server dom4j-1.6.1-4.9.4 as a component of SUSE Manager Server Module 4.0 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. CVE-2020-10683 Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:dom4j-1.6.1-4.9.4 Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:dom4j-1.6.1-4.9.4 Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:dom4j-1.6.1-4.9.4 SUSE Manager Server Module 4.0:dom4j-1.6.1-4.9.4 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201383-1/ https://www.suse.com/security/cve/CVE-2020-10683.html CVE-2020-10683 https://bugzilla.suse.com/1169760 SUSE Bug 1169760