https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 21:08:33 +0000 https://cve.radiocsirt.org/vuln/ghsa-826p-4gcg-35vw <p><strong>Affected:</strong> Maven: org.geotools:gt-xsd-core, Maven: org.geotools:gt-wfs-ng</p> <p>### Summary</p> <p>GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.</p> <p>### Impact</p> <p>This impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).</p> <p>This also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.</p> <p>### Resolution</p> <p>GeoTools API change allows EntityResolver to be supplied to the following methods:</p> <p>```java Schemas.parse( location, locators, resolvers, uriHandlers, entityResolver); Schemas.findSchemas(Configuration configuration, EntityResolver entityResolver); ```</p> <p>With this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.</p> <p>### Reference</p> <p>* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.</p> <p>* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.</p> <p><strong>Affected:</strong> Maven: org.geotools:gt-xsd-core, Maven: org.geotools:gt-wfs-ng</p> <p>### Summary</p> <p>GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.</p> <p>### Impact</p> <p>This impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).</p> <p>This also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.</p> <p>### Resolution</p> <p>GeoTools API change allows EntityResolver to be supplied to the following methods:</p> <p>```java Schemas.parse( location, locators, resolvers, uriHandlers, entityResolver); Schemas.findSchemas(Configuration configuration, EntityResolver entityResolver); ```</p> <p>With this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.</p> <p>### Reference</p> <p>* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.</p> <p>* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.</p> https://cve.radiocsirt.org/vuln/ghsa-826p-4gcg-35vw