=====================================================================

                                 CERT-Renater

                      Note d'Information No. 2023/VULN254

_____________________________________________________________________

DATE                : 23/08/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Ivy versions prior to 2.5.2.

=====================================================================
https://lists.apache.org/thread/1dj60hg5nr36kjr4p1100dwjrqookps8
_____________________________________________________________________

Severity: moderate

Affected versions:

- - Apache Ivy 1.0.0 through 2.5.1

Description:

Improper Restriction of XML External Entity Reference, XML Injection
(aka Blind XPath Injection) vulnerability in Apache Software
Foundation Apache Ivy.This issue affects any version of Apache Ivy
prior to 2.5.2.

When Apache Ivy prior to 2.5.2 parses XML files - either its own
configuration, Ivy files or Apache Maven POMs - it will allow
downloading external document type definitions and expand any
entity references contained therein when used.

This can be used to exfiltrate data, access resources only the
machine running Ivy has access to or disturb the execution of
Ivy in different ways.

Starting with Ivy 2.5.2 DTD processing is disabled by default
except when parsing Maven POMs where the default is to allow
DTD processing but only to include a DTD snippet shipping with
Ivy that is needed to deal with existing Maven POMs that are
not valid XML files but are nevertheless accepted by Maven.
Access can be be made more lenient via newly introduced system
properties where needed.

Users of Ivy prior to version 2.5.2 can use Java system properties to 
restrict processing of external DTDs, see the
section about "JAXP Properties for External Access restrictions"
inside Oracle's "Java API for XML Processing (JAXP) Security
Guide".


Credit:

CC Bomber, Kitri BoB (finder)
Jenkins Security Team (reporter)

References:

https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-94ABC0EE-9DC8-44F0-84AD-47ADD5340477
https://gitbox.apache.org/repos/asf?p=ant-ivy.git;a=commit;h=2be17bc18b0e1d4123007d579e43ba1a4b6fab3d
https://lists.apache.org/thread/9gcz4xrsn8c7o9gb377xfzvkb8jltffr
https://ant.apache.org/
https://www.cve.org/CVERecord?id=CVE-2022-46751


Timeline:

2022-11-30: reported to the ASF security team
2023-08-20: made public

_____________________________________________________________________

The Apache Ant Team is pleased to announce the release of Apache Ivy
2.5.2.

Apache Ivy is a dependency manager focusing on flexibility and
simplicity with strong integration into the Apache Ant build tool.

Ivy 2.5.2 is bugfix release and addresses an XML external entity
injection vulnerability, see the upcoming CVE announcement or
https://ant.apache.org/ivy/security.html for details.

Source and binary distributions are available for download from the
Apache Ivy download site:

https://ant.apache.org/ivy/download.cgi

When downloading, please verify signatures using the KEYS file
available at the above location when downloading the release.


Changes in 2.5.2 include:
=========================

- FIX: ivy:retrieve could fail because of a `NullPointerException` 
(jira:IVY-1641[])
- FIX: reading POMs may loose dependencies when multiple Maven
   dependencies only differ in `classifier` (jira:IVY-1642[])
- IMPROVEMENT: Upgrade Apache HttpClient to 4.5.13 (jira:IVY-1644[])
- FIX: CVE-2022-46751: Apache Ivy Is Vulnerable to XML External
Entity Injections

For complete information on Ivy, including instructions on how to
submit bug reports, patches, or suggestions for improvement, see
the Apache Ivy website:

https://ant.apache.org/ivy/

Stefan Bodewig, on behalf of the Apache Ant community

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================