[Fedora-i18n-bugs] [Bug 1527789] New: translate-toolkit: Maliciously crafted .XLF files can result arbitrary file read and potential code exection

https://bugzilla.redhat.com/show_bug.cgi?id=1527789

            Bug ID: 1527789
           Summary: translate-toolkit: Maliciously crafted .XLF files can
                    result arbitrary file read and potential code exection
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: sfowler(a)redhat.com
                CC: dwayne(a)translate.org.za,
                    i18n-bugs(a)lists.fedoraproject.org, mfabian(a)redhat.com,
                    mmraka(a)redhat.com, petersen(a)redhat.com



translate-toolkit before version 2.2.0 is vulnerable to XML External Entity
Execution. An attacker could exploit this by supplying a maliciously crafted
.XLF file causing an arbitrary file read or potential arbitrary code execution.

References:
https://bugzilla.novell.com/show_bug.cgi?id=1073535
https://github.com/translate/translate/pull/3632/files
https://hackerone.com/reports/232614

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1527789] translate-toolkit: Maliciously crafted .XLF files can result arbitrary file read and potential code exection

https://bugzilla.redhat.com/show_bug.cgi?id=1527789

Sam Fowler <sfowler(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1527790



--- Comment #1 from Sam Fowler <sfowler(a)redhat.com&gt; ---
Created translate-toolkit tracking bugs for this issue:

Affects: epel-all [bug 1527790]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1527790
[Bug 1527790] translate-toolkit: Maliciously crafted .XLF files can result
arbitrary file read and potential code exection [epel-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.