Description
Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| liquibase | liquibase/liquibase | unspecified – < 4.8.0 | 4.8.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7 +1 | 1-4.el7sso | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-javapackages-tools +1 | 3.4.1-5.15.3.jbcs.el7 | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.0-2.redhat_00001.1.el7sso | RHBA-2022:5454, RHBA-2022:5452 |
| Red Hat Single Sign On 7 | rh-sso7-python3-javapackages | 3.4.1-5.15.6.el8sso | RHBA-2022:5454 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.liquibase:liquibase-core | < 4.8.0 | 4.8.0 | GHSA-jvfv-hrrc-6q72 |
Advisories 2
- RHBA-2022:5454 Red Hat Bug Fix Advisory: Red Hat Single Sign-On 7.6.0 update on RHEL 8 Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHBA-2022:5452 Red Hat Bug Fix Advisory: Red Hat Single Sign-On 7.6.0 update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 11, 2026