GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. ### Impact This impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. ### Resolution GeoTools API change allows EntityResolver to be supplied to the following methods: ```java Schemas.parse( location, locators, resolvers, uriHandlers, entityResolver); Schemas.findSchemas(Configuration configuration, EntityResolver entityResolver); ``` With this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used. ### Reference * [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files. * [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | org.geotools:gt-xsd-core (Maven) | 33.0 to before 33.1 | 33.1 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-xsd-core (Maven) | 32.0 to before 32.3 | 32.3 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-xsd-core (Maven) | 29.0 to before 31.7 | 31.7 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-wfs-ng (Maven) | 33.0 to before 33.1 | 33.1 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-wfs-ng (Maven) | 32.0 to before 32.3 | 32.3 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-wfs-ng (Maven) | 29.0 to before 31.7 | 31.7 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-xsd-core (Maven) | before 28.6.1 | 28.6.1 | Patch available | GHSA-826p-4gcg-35vw |
| — | org.geotools:gt-wfs-ng (Maven) | before 28.6.1 | 28.6.1 | Patch available | GHSA-826p-4gcg-35vw |
- org.geotools:gt-xsd-core (Maven) Vendor— Affected 33.0 to before 33.1 Fixed in 33.1 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-xsd-core (Maven) Vendor— Affected 32.0 to before 32.3 Fixed in 32.3 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-xsd-core (Maven) Vendor— Affected 29.0 to before 31.7 Fixed in 31.7 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-wfs-ng (Maven) Vendor— Affected 33.0 to before 33.1 Fixed in 33.1 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-wfs-ng (Maven) Vendor— Affected 32.0 to before 32.3 Fixed in 32.3 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-wfs-ng (Maven) Vendor— Affected 29.0 to before 31.7 Fixed in 31.7 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-xsd-core (Maven) Vendor— Affected before 28.6.1 Fixed in 28.6.1 Patch available GHSA-826p-4gcg-35vw
- org.geotools:gt-wfs-ng (Maven) Vendor— Affected before 28.6.1 Fixed in 28.6.1 Patch available GHSA-826p-4gcg-35vw
Remediation
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-xsd-core (Maven) Fixed in 33.1 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-xsd-core (Maven) Fixed in 32.3 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-xsd-core (Maven) Fixed in 31.7 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-wfs-ng (Maven) Fixed in 33.1 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-wfs-ng (Maven) Fixed in 32.3 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-wfs-ng (Maven) Fixed in 31.7 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-xsd-core (Maven) Fixed in 28.6.1 Advisory →
- Fix · GHSA-826p-4gcg-35vw org.geotools:gt-wfs-ng (Maven) Fixed in 28.6.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-826p-4gcg-35vw
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences