Vulnerability Description
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Diffplug | Gradle | < 3.20.0 |
| Diffplug | Maven | < 1.20.0 |
Related Weaknesses (CWE)
References
- https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#versioRelease NotesThird Party Advisory
- https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#versionRelease NotesThird Party Advisory
- https://github.com/diffplug/spotless/issues/358Issue TrackingThird Party Advisory
- https://github.com/diffplug/spotless/pull/369Issue TrackingThird Party Advisory
- https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf1
- https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#versioRelease NotesThird Party Advisory
- https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#versionRelease NotesThird Party Advisory
- https://github.com/diffplug/spotless/issues/358Issue TrackingThird Party Advisory
- https://github.com/diffplug/spotless/pull/369Issue TrackingThird Party Advisory
- https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf1
FAQ
What is CVE-2019-9843?
CVE-2019-9843 is a vulnerability with a CVSS score of 7.5 (HIGH). In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveE...
How severe is CVE-2019-9843?
CVE-2019-9843 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9843?
Check the references section above for vendor advisories and patch information. Affected products include: Diffplug Gradle, Diffplug Maven.