[GHSA-75vw-3m5v-fprh] corenlp is vulnerable to Improper Restriction of XML External Entity Reference

[tjuyuxinzhang]

Updates

• Affected products
• References

Comments
The current advisory is incomplete because it lists affected versions as <= 4.3.2 but leaves the patched versions field empty. The package-level fixed release should be 4.4.0. This is supported by Snyk, which lists the Maven package range as [,4.4.0) and recommends upgrading to 4.4.0 or higher, and by upstream PR #1242, where the author explicitly states “Look for 4.4.0” when asked which release contains the fix. The upstream fix commit 1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd adds XMLConstants.FEATURE_SECURE_PROCESSING to the SchemaFactory, confirming the code-level remediation. Updating the advisory to use affected versions < 4.4.0 and patched version 4.4.0 makes the record more accurate and actionable for Maven package consumers.

Description

CVE-2022-0239 affects edu.stanford.nlp:stanford-corenlp when a malicious XML schema is passed to getValidatingXmlParser(). The vulnerable code creates a SchemaFactory without enabling secure processing, which allows external entity resolution during schema parsing.

This can lead to XML External Entity (XXE) Injection, with impacts including local file disclosure, server-side request forgery (SSRF), and denial of service, depending on how the library is used by the consuming application.

The issue is fixed by enabling XMLConstants.FEATURE_SECURE_PROCESSING in the XML schema factory configuration.

Affected Maven package versions are all versions before 4.4.0. The first fixed package release is 4.4.0.

[advisory-database]

Hi @tjuyuxinzhang! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!