Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | xmlunit | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-assertj | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-core | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-javadoc | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-legacy | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-matchers | 0:2.8.2-6.amzn2023.0.4 |
| Amazon Linux · 2023 | xmlunit-placeholders | 0:2.8.2-6.amzn2023.0.4 |
Vulnerabilities 1
-
Medium 4.0
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-31573.html