CRITICAL9.8

GHSA-pjch-4g28-fxx7

External Entity Reference in TwelveMonkeys ImageIO

Quick fix

GHSA-pjch-4g28-fxx7 — com.twelvemonkeys.imageio:imageio-metadata: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.7.1</version> for com.twelvemonkeys.imageio:imageio-metadata

Details

The package com.twelvemonkeys.imageio:imageio-metadata before version 3.7.1 is vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/com.twelvemonkeys.imageio:imageio-metadata

Introduced in: 0Fixed in: 3.7.1

Fix# pom.xml: bump <version>3.7.1</version> for com.twelvemonkeys.imageio:imageio-metadata

Details

Are you affected?

Affected packages

References