CVE-2019-20627: Improper Restriction of XML External Entity Reference (CWE-611)
value: AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2020-03-23T17:15Z
Repository: https://github.com/ravibpatel/AutoUpdater.NET
Language: C#
Files changed: AutoUpdater.NET/AutoUpdater.cs, AutoUpdater.NET/Properties/AssemblyInfo.cs, AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec, appveyor.yml
Commit date: 2019-10-31 11:32:24 +0530
Commit message: Fixed an XML external entity (XXE) vulnerability.

Diff: diff --git a/AutoUpdater.NET/AutoUpdater.cs b/AutoUpdater.NET/AutoUpdater.cs
index c8a6501..52c979d 100644
--- a/AutoUpdater.NET/AutoUpdater.cs
+++ b/AutoUpdater.NET/AutoUpdater.cs
@@ -460,12 +460,11 @@ namespace AutoUpdaterDotNET
                             args = parseArgs.UpdateInfo;
                         }
                     }
                     else
                     {
-                        XmlDocument receivedAppCastDocument = new XmlDocument();
-
+                        XmlDocument receivedAppCastDocument = new XmlDocument {XmlResolver = null};
                         try
                         {
                             receivedAppCastDocument.Load(appCastStream);
 
                             XmlNodeList appCastItems = receivedAppCastDocument.SelectNodes("item");
diff --git a/AutoUpdater.NET/Properties/AssemblyInfo.cs b/AutoUpdater.NET/Properties/AssemblyInfo.cs
index b466825..c02b883 100644
--- a/AutoUpdater.NET/Properties/AssemblyInfo.cs
+++ b/AutoUpdater.NET/Properties/AssemblyInfo.cs
@@ -30,8 +30,8 @@ using System.Resources;
 //      Revision
 //
 // You can specify all the values or you can default the Build and Revision Numbers 
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.5.7.0")]
-[assembly: AssemblyFileVersion("1.5.7.0")]
+[assembly: AssemblyVersion("1.5.8.0")]
+[assembly: AssemblyFileVersion("1.5.8.0")]
 [assembly: NeutralResourcesLanguageAttribute("en")]
diff --git a/AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec b/AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec
index 21b0013..6b97b7e 100644
--- a/AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec
+++ b/AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec
@@ -1,10 +1,10 @@
 ﻿<?xml version="1.0" encoding="utf-8"?>
 <package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
     <metadata>
         <id>Autoupdater.NET.Official</id>
-        <version>1.5.7</version>
+        <version>1.5.8</version>
         <title>AutoUpdater.NET</title>
         <authors>RBSoft</authors>
         <owners>RBSoft</owners>
         <license type="expression">MIT</license>
         <projectUrl>https://github.com/ravibpatel/AutoUpdater.NET</projectUrl>
diff --git a/appveyor.yml b/appveyor.yml
index fe4a071..724235b 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,8 +1,8 @@
-version: 1.5.7.{build}
+version: 1.5.8.{build}
 environment:
-  my_version: 1.5.7
+  my_version: 1.5.8
   my_secret:
     secure: vbPRaZLQYpGPr4BrZZ4p6TofpSZMud+FKtlpqjgO8aA=
 skip_branch_with_pr: true
 image: Visual Studio 2017
 clone_folder: c:\projects\AutoUpdater.NET

Vulnerable code:                         XmlDocument receivedAppCastDocument = new XmlDocument();

[assembly: AssemblyVersion("1.5.7.0")]
[assembly: AssemblyFileVersion("1.5.7.0")]
        <version>1.5.7</version>
version: 1.5.7.{build}
  my_version: 1.5.7
Fixed code:                         XmlDocument receivedAppCastDocument = new XmlDocument {XmlResolver = null};
[assembly: AssemblyVersion("1.5.8.0")]
[assembly: AssemblyFileVersion("1.5.8.0")]
        <version>1.5.8</version>
version: 1.5.8.{build}
  my_version: 1.5.8