You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by fa...@apache.org on 2021/01/13 17:36:15 UTC
svn commit: r1885439 - /poi/site/src/documentation/content/xdocs/index.xml
Author: fanningpj
Date: Wed Jan 13 17:36:15 2021
New Revision: 1885439
URL: http://svn.apache.org/viewvc?rev=1885439&view=rev
Log:
add CVE info to news section
Modified:
poi/site/src/documentation/content/xdocs/index.xml
Modified: poi/site/src/documentation/content/xdocs/index.xml
URL: http://svn.apache.org/viewvc/poi/site/src/documentation/content/xdocs/index.xml?rev=1885439&r1=1885438&r2=1885439&view=diff
==============================================================================
--- poi/site/src/documentation/content/xdocs/index.xml (original)
+++ poi/site/src/documentation/content/xdocs/index.xml Wed Jan 13 17:36:15 2021
@@ -27,6 +27,23 @@
<body>
<section><title>Project News</title>
+ <section><title>13 January 2020 - CVE-2021-23926 - XML External Entity (XXE) Processing in Apache XMLBeans versions prior to 3.0.0</title>
+ <p>Description:<br/>
+ When parsing XML files using XMLBeans 2.6.0 or below, the underlying parser
+ created by XMLBeans could be susceptible to XML External Entity (XXE) attacks.</p>
+
+ <p>This issue was fixed a few years ago but on review, we decided we should have a CVE
+ to raise awareness of the issue.</p>
+
+ <p>Mitigation:<br/>
+ Affected users are advised to update to Apache XMLBeans 3.0.0 or above
+ which fixes this vulnerability. XMLBeans 4.0.0 or above is preferable.</p>
+
+ <p>References:
+ <a href="https://en.wikipedia.org/wiki/XML_external_entity_attack">XML external entity attack</a>
+ </p>
+ </section>
+
<section><title>18 October 2020 - XMLBeans 4.0.0 available</title>
<p>The Apache POI team is pleased to announce the release of XMLBeans 4.0.0.
This release features some updates to support Saxon-HE 10.</p>
@@ -61,7 +78,7 @@
<p>Mitigation:<br/>
Apache POI 4.1.0 and before: users who do not use the tool XSSFExportToXml
- are not affected. affected users are advised to update to Apache POI 4.1.1
+ are not affected. Affected users are advised to update to Apache POI 4.1.1
which fixes this vulnerability.</p>
<p>Credit:
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org