Summary
It was discovered that JGraphX did not disable XML external entity
processing when converting certain XML input to images. An attacker could
possibly use this issue to obtain sensitive information or cause a denial
of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libjgraphx-java | 2.1.0.7-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libjgraphx-java | 2.1.0.7-1ubuntu0.18.04.1~esm1 |
Vulnerabilities 1
-
Critical 9.8
mxGraph vulnerable to XXE attacks
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
References
-
report
https://ubuntu.com/security/CVE-2017-18197