initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description (CVE-2019-13990). References: . MGASA-2021-0133 - Updated quartz packages fix a security vulnerability Publication date: 14 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0133.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-13990 initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description (CVE-2019-13990). References: - https://bugs.mageia.org/show_bug.cgi?id=26481 - https://lists.suse.com/pipermail/sle-security-updates/2020-April/006708.html - https://www.cve.org/CVERecord?id=CVE-2019-13990 SRPMS: - 7/core/quartz-2.2.1-9.1.mga7 . Fedora 2021-0325 addresses critical vulnerabilities with the release of new patches. Release date: 22 Apr 2021.. Quartz Security Fix, Mageia Update, XML Scheduling Vulnerability. . LinuxSecurity.com Team
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for quartz ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1009-1 Rating: moderate References: #1143227 Cross-References: CVE-2019-13990 Affected Products: SUSE Manager Server 3.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser (bsc#1143227). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Server 3.2: zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2020-1009=1 Package List: - SUSE Manager Server 3.2 (noarch): quartz-2.3.0-14.3.1 References: https://www.suse.com/security/cve/CVE-2019-13990.html https://bugzilla.suse.com/1143227 _______________________________________________ sle-security-updates mailing list
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for quartz ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:0984-1 Rating: moderate References: #1143227 Cross-References: CVE-2019-13990 Affected Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser (bsc#1143227). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2020-984=1 Package List: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (noarch): quartz-2.3.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13990.html https://bugzilla.suse.com/1143227 _______________________________________________ sle-security-updates mailing list
Get the latest Linux and open source security news straight to your inbox.