Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdwMzItN2gyOS1ycHht

Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle

Checkstyle prior to 8.18 loads external DTDs by default, which can potentially lead to denial of service attacks or the leaking of confidential information.

Permalink: https://github.com/advisories/GHSA-gp32-7h29-rpxm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdwMzItN2gyOS1ycHht
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago


CVSS Score: 5.3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00788
EPSS Percentile: 0.81758

Identifiers: GHSA-gp32-7h29-rpxm, CVE-2019-9658
References: Repository: https://github.com/checkstyle/checkstyle
Blast Radius: 16.7

Affected Packages

maven:com.puppycrawl.tools:checkstyle
Dependent packages: 163
Dependent repositories: 1,425
Downloads:
Affected Version Ranges: < 8.18
Fixed in: 8.18
All affected versions: 6.1.1, 6.4.1, 6.8.1, 6.8.2, 6.10.1, 6.11.1, 6.11.2, 6.12.1, 6.14.1, 6.16.1, 7.1.1, 7.1.2, 7.5.1, 7.6.1, 7.8.1, 7.8.2, 8.10.1
All unaffected versions: 8.36.1, 8.36.2, 8.41.1, 8.45.1, 9.0.1, 9.2.1, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.5.0, 10.6.0, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.9.1, 10.9.2, 10.9.3, 10.10.0, 10.11.0, 10.12.0, 10.12.1, 10.12.2, 10.12.3, 10.12.4, 10.12.5, 10.12.6, 10.12.7, 10.13.0, 10.14.0, 10.14.1, 10.14.2, 10.15.0, 10.16.0, 10.17.0, 10.18.0, 10.18.1, 10.18.2, 10.19.0, 10.20.0, 10.20.1, 10.20.2