Security researchers from Snyk discovered that the fix for CVE-2019-9658 was incomplete. Checkstyle, a development tool to help programmers write Java code that adheres to a coding standard, was still vulnerable to XML External Entity (XXE) injection. . Package : checkstyle Version : 5.9-1+deb8u2 CVE ID : CVE-2019-10782 Security researchers from Snyk discovered that the fix for CVE-2019-9658 was incomplete. Checkstyle, a development tool to help programmers write Java code that adheres to a coding standard, was still vulnerable to XML External Entity (XXE) injection. For Debian 8 "Jessie", this problem has been fixed in version 5.9-1+deb8u2. We recommend that you upgrade your checkstyle packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Follow these steps to mitigate the XXE injection vulnerability in Checkstyle on Debian 8 Jessie and enhance your system's security effectively. Checkstyle Security Update, Debian 8, XML Injection Fix, Security Advisory, Java Development Tool. . LinuxSecurity.com Team
checkstyle was loading external DTDs by default, which is now disabled by default. If needed it can be re-enabled by setting the system property . Package : checkstyle Version : 5.9-1+deb8u1 CVE ID : CVE-2019-9658 checkstyle was loading external DTDs by default, which is now disabled by default. If needed it can be re-enabled by setting the system property checkstyle.enableExternalDtdLoad to true. For Debian 8 "Jessie", this problem has been fixed in version 5.9-1+deb8u1. We recommend that you upgrade your checkstyle packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Checkstyle security patch for Debian LTS now prohibits loading external DTDs by default. Update to safeguard your system.. checkstyle update, Debian security, disabled DTD loading, secure configuration. . LinuxSecurity.com Team
This update fixes security vulnerability - Checkstyle loads external DTDs by default. Upstream issue: https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478 References: https://checkstyle.org/releasenotes.html#Release_8.18. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-e4405b4c9f 2019-04-12 01:16:13.517539 --------------------------------------------------------------------------------Name : checkstyle Product : Fedora 29 Version : 8.0 Release : 4.1.fc29 URL : https://checkstyle.sourceforge.io/ Summary : Java source code checker Description : A tool for checking Java source code for adherence to a set of rules. --------------------------------------------------------------------------------Update Information: This update fixes security vulnerability - Checkstyle loads external DTDs by default. Upstream issue: https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478 References: https://checkstyle.org/releasenotes.html#Release_8.18 --------------------------------------------------------------------------------ChangeLog: * Tue Apr 2 2019 Mikolaj Izdebski - 8.0-4.1 - Do not load external DTDs by default - Resolves: CVE-2019-9658 --------------------------------------------------------------------------------References: [ 1 ] Bug #1694857 - CVE-2019-9658 checkstyle: Loads external DTDs by default https://bugzilla.redhat.com/show_bug.cgi?id=1694857 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-e4405b4c9f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPGkeys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
This update fixes security vulnerability - Checkstyle loads external DTDs by default. Upstream issue: https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478 References: https://checkstyle.org/releasenotes.html#Release_8.18. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-a3f67e2364 2019-04-11 18:43:14.104242 --------------------------------------------------------------------------------Name : checkstyle Product : Fedora 28 Version : 8.0 Release : 4.1.fc28 URL : https://checkstyle.sourceforge.io/ Summary : Java source code checker Description : A tool for checking Java source code for adherence to a set of rules. --------------------------------------------------------------------------------Update Information: This update fixes security vulnerability - Checkstyle loads external DTDs by default. Upstream issue: https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478 References: https://checkstyle.org/releasenotes.html#Release_8.18 --------------------------------------------------------------------------------ChangeLog: * Tue Apr 2 2019 Mikolaj Izdebski - 8.0-4.1 - Do not load external DTDs by default - Resolves: CVE-2019-9658 * Thu Jul 12 2018 Fedora Release Engineering - 8.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1694857 - CVE-2019-9658 checkstyle: Loads external DTDs by default https://bugzilla.redhat.com/show_bug.cgi?id=1694857 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-a3f67e2364' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.