CVE-2022-28890: Improper Restriction of XML External Entity Reference

May 5, 2022 (updated October 25, 2023)

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

References

lists.apache.org/thread/h88oh642455wljo0p5jgzs9phk4gj878
nvd.nist.gov/vuln/detail/CVE-2022-28890

Code Behaviors & Features

Detect and mitigate CVE-2022-28890 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →