Siemens Polarion ALM

CVEs (1)

Remediations

• Set the below configurations to mitigate against external entity injection in OpenSAML 4.x parser configuration. This will be included by default on Polarion V2304 and later versions. parserPool.setMaxPoolSize(100); parserPool.setCoalescing(true); parserPool.setIgnoreComments(true); parserPool.setIgnoreElementContentWhitespace(true); parserPool.setNamespaceAware(true); parserPool.setExpandEntityReferences(false); parserPool.setXincludeAware(false); final Map<String, Boolean> features = new HashMap<String, Boolean>(); features.put(http://xml.org/sax/features/external-general-entities, Boolean.FALSE); features.put(http://xml.org/sax/features/external-parameter-entities, Boolean.FALSE); features.put(http://apache.org/xml/features/disallow-doctype-decl, Boolean.TRUE); features.put(http://apache.org/xml/features/validation/schema/normalized-value, Boolean.FALSE); features.put(http://javax.xml.XMLConstants/feature/secure-processing, Boolean.TRUE); parserPool.setBuilderFeatures(features);
• Update to V22R2 or later version

Affected Vendors

Affected Products (1)

Affected Sectors

Multiple