Security update for nutch-core SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0323-1 Final 1 1 2021-02-08T09:30:11Z current 2021-02-08T09:30:11Z 2021-02-08T09:30:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nutch-core This update for nutch-core fixes the following issue: - CVE-2021-23901: fixed an XML external entity (XXE) injection in `DmozParser` (bsc#1181356) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2021-323,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2021-323,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2021-323,SUSE-2021-323,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-323 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210323-1/ Link for SUSE-SU-2021:0323-1 https://lists.suse.com/pipermail/sle-security-updates/2021-February/008278.html E-Mail link for SUSE-SU-2021:0323-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181356 SUSE Bug 1181356 https://www.suse.com/security/cve/CVE-2021-23901/ SUSE CVE CVE-2021-23901 page Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE SUSE Manager Server Module 4.1 nutch-core-1.0.1-4.3.1 nutch-core-1.0.1-4.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure nutch-core-1.0.1-4.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM nutch-core-1.0.1-4.3.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE nutch-core-1.0.1-4.3.1 as a component of SUSE Manager Server Module 4.1 An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18. CVE-2021-23901 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:nutch-core-1.0.1-4.3.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:nutch-core-1.0.1-4.3.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:nutch-core-1.0.1-4.3.1 SUSE Manager Server Module 4.1:nutch-core-1.0.1-4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210323-1/ https://www.suse.com/security/cve/CVE-2021-23901.html CVE-2021-23901 https://bugzilla.suse.com/1181356 SUSE Bug 1181356