GitHub Advisoryadvisory · Hex

GHSA-qpmc-wprv-x746 Inline DTD allows XML bomb attack

HIGH Published 2022-04-12 Modified 2022-04-12 Official page ↗
Aliases
CVE-2019-15160
Ecosystem
Hex
Packages
sweet_xml
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611, CWE-776
Reviewed
2022-04-12

Affected packages

• Hex sweet_xml: < 0.7.0 → fixed in 0.7.0

Description

The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.

Related

Alias · CVE (1)

  • CVE-2019-15160 The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource… vulnerability

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References