CVE-2020-1693: Improper Restriction of XML External Entity Reference (CWE-611)
value: A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2020-02-17T20:15Z
Repository: https://github.com/spacewalkproject/spacewalk
Language: Other
Files changed: spec-tree/redstone-xmlrpc/redstone-xmlrpc.spec, spec-tree/redstone-xmlrpc/xxe2.patch
Commit date: 2020-02-11 11:39:06 +0100
Commit message: 1791164 - disable external entity parsing

Diff: diff --git a/spec-tree/redstone-xmlrpc/redstone-xmlrpc.spec b/spec-tree/redstone-xmlrpc/redstone-xmlrpc.spec
index 9179fcce770..0ba07aca4eb 100644
--- a/spec-tree/redstone-xmlrpc/redstone-xmlrpc.spec
+++ b/spec-tree/redstone-xmlrpc/redstone-xmlrpc.spec
@@ -7,10 +7,11 @@ URL: http://xmlrpc.sourceforge.net
 Source0: %{name}-%{version}.tar.gz
 Patch0: build-classpath.patch
 Patch1: fault_serialization.patch
 Patch2: escaping_string_serialization.path
 Patch3: xxe.patch
+Patch4: xxe2.patch
 %if 0%{?fedora} || 0%{?rhel} >=7
 BuildRequires: javapackages-tools
 BuildRequires: jboss-servlet-2.5-api
 Requires: jboss-servlet-2.5-api
 %define third_party_jars jboss-servlet-2.5-api
@@ -32,10 +33,11 @@ a simple xmlrpc library for java
 %setup -n xmlrpc
 %patch0 -p1
 %patch1 -p0
 %patch2 -p0
 %patch3 -p0
+%patch4 -p0
 rm lib/javax.servlet.jar
 build-jar-repository -p lib/ %third_party_jars
 
 %build
 ant jars
diff --git a/spec-tree/redstone-xmlrpc/xxe2.patch b/spec-tree/redstone-xmlrpc/xxe2.patch
new file mode 100644
index 00000000000..59dfb4ef419
--- /dev/null
+++ b/spec-tree/redstone-xmlrpc/xxe2.patch
@@ -0,0 +1,11 @@
+diff '--exclude=CVS' '--exclude=.svn' -ur ../xmlrpc-orig/source/redstone/xmlrpc/XmlRpcParser.java ../xmlrpc/source/redstone/xmlrpc/XmlRpcParser.java
+--- source/redstone/xmlrpc/XmlRpcParser.java	2020-01-16 14:18:28.294284905 +0100
++++ source/redstone/xmlrpc/XmlRpcParser.java	2020-01-16 14:21:57.985203925 +0100
+@@ -135,6 +135,7 @@
+                 {
+                     reader = XMLReaderFactory.createXMLReader();
+                     reader.setEntityResolver(new DummyEntityResolver());
++                    reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+                 }
+                 catch ( SAXException e )
+                 {

Fixed code: Patch4: xxe2.patch
%patch4 -p0
diff '--exclude=CVS' '--exclude=.svn' -ur ../xmlrpc-orig/source/redstone/xmlrpc/XmlRpcParser.java ../xmlrpc/source/redstone/xmlrpc/XmlRpcParser.java
--- source/redstone/xmlrpc/XmlRpcParser.java	2020-01-16 14:18:28.294284905 +0100
@@ -135,6 +135,7 @@
                 {
                     reader = XMLReaderFactory.createXMLReader();
                     reader.setEntityResolver(new DummyEntityResolver());
+                    reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
                 }
                 catch ( SAXException e )
                 {