VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 30, 2020· Updated Aug 4, 2024

CVE-2019-10782

CVE-2019-10782

Description

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.puppycrawl.tools:checkstyleMaven
< 8.298.29

Affected products

1

Patches

1
c46a16d177e6

Issue #7468: disable 'external-parameter-entities' feature by default

https://github.com/checkstyle/checkstyleRoman IvanovJan 19, 2020via ghsa
commit
1 file changed · +4 −0
  • src/main/java/com/puppycrawl/tools/checkstyle/XmlLoader.java+4 −0 modified
    @@ -124,6 +124,9 @@ public static final class LoadExternalDtdFeatureProvider {
         /** Feature that enables including external general entities in XML files. */
         public static final String EXTERNAL_GENERAL_ENTITIES =
                 "http://xml.org/sax/features/external-general-entities";
+        /** Feature that enables including external parameter entities in XML files. */
+        public static final String EXTERNAL_PARAMETER_ENTITIES =
+                "http://xml.org/sax/features/external-parameter-entities";
 
         /** Stop instances being created. **/
         private LoadExternalDtdFeatureProvider() {
@@ -146,6 +149,7 @@ public static void setFeaturesBySystemProperty(SAXParserFactory factory)
 
             factory.setFeature(LOAD_EXTERNAL_DTD, enableExternalDtdLoad);
             factory.setFeature(EXTERNAL_GENERAL_ENTITIES, enableExternalDtdLoad);
+            factory.setFeature(EXTERNAL_PARAMETER_ENTITIES, enableExternalDtdLoad);
         }
 
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.