CVE-2018-1000844 XML External Entity (XXE) vulnerability in Square Retrofit

What is CVE-2018-1000844?

CVE-2018-1000844 is a critical vulnerability in n/a, published on 20 Dec 2018.

Official description

Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.

Weakness: CWE-611

Which versions are affected by CVE-2018-1000844?

2 open source packages ship an affected version, including com.squareup.retrofit2:retrofit. It affects 1 product.

Products include Squareup Retrofit.

How do I fix CVE-2018-1000844?

Upgrade com.squareup.retrofit2:retrofit to 2.5.0 or later.

Is CVE-2018-1000844 being exploited?

There is no known exploitation of CVE-2018-1000844 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2018-1000850 Directory Traversal vulnerability in Square Retrofit High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j379-9jr9-w5cq.