CVE-2019-9658: com.puppycrawl.tools:checkstyle - External DTD Loading Vulnerability
Summary
CVE-2019-9658: Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle. Affects com.puppycrawl.tools:checkstyle versions < 8.18. Fixed in 8.18. How to fix ↓
Also tracked for
- checkstyle · Debian:11
The same CVE-2019-9658 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
com.puppycrawl.tools:checkstyle is a Maven package that provides a static code analysis tool for Java. It helps developers enforce coding standards and identify potential issues in their codebase. This package is vulnerable to an external DTD loading issue in versions prior to 8.18. By default, Checkstyle loads external DTDs, which can lead to denial of service attacks or the leaking of confidential information.
Vulnerability Detail
The vulnerability in com.puppycrawl.tools:checkstyle arises from its default behavior of loading external DTDs. This can be exploited by an attacker to launch denial of service attacks or gain unauthorized access to confidential information. By manipulating the DTDs, an attacker can cause the application to consume excessive resources or disclose sensitive data. This vulnerability has a CVSS score of 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
How To Fix
Minimum fixed version
8.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround is to manually disable the loading of external DTDs in the Checkstyle configuration. This can be achieved by modifying the configuration file to set the 'enableExternalEntities' property to 'false'. Here is an example of the modified configuration:
<module name="Checker">
<property name="enableExternalEntities" value="false"/>
...
</module>
By applying this workaround, the application will be protected from the vulnerability until a proper upgrade can be performed.
Conclusion
In conclusion, com.puppycrawl.tools:checkstyle prior to version 8.18 is vulnerable to external DTD loading, which can result in denial of service attacks or the exposure of confidential information. It is recommended to upgrade to version 8.18 or later to mitigate this vulnerability. If immediate upgrade is not possible, a temporary workaround can be applied by disabling the loading of external DTDs in the Checkstyle configuration. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.puppycrawl.tools:checkstyle →
FAQ
com.puppycrawl.tools:checkstyle is a Maven package that provides a static code analysis tool for Java. It helps enforce coding standards and identify potential issues in Java codebases.
This vulnerability can lead to denial of service attacks or the leaking of confidential information. Attackers can exploit the loading of external DTDs to consume excessive resources or gain unauthorized access to sensitive data.
To fix this vulnerability, upgrade com.puppycrawl.tools:checkstyle to version 8.18 or later. This version disables the loading of external DTDs by default, mitigating the risk.
Yes, a temporary workaround is to manually disable the loading of external DTDs in the Checkstyle configuration. This can be achieved by modifying the configuration file and setting the 'enableExternalEntities' property to 'false'.
The CVSS score of this vulnerability is 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
Related vulnerabilities
Recent vulnerabilities recorded for com.puppycrawl.tools:checkstyle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
