CVE-2019-17637

Name	CVE-2019-17637
Description	In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-2404-1
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
eclipse-wtp (PTS)	stretch	3.6.3-3	vulnerable
	stretch (security)	3.6.3-3+deb9u1	fixed
	bookworm, sid, bullseye	3.18-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
eclipse-wtp	source	stretch	3.6.3-3+deb9u1		DLA-2404-1
eclipse-wtp	source	(unstable)	3.18-1

Notes

https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571
http://git.eclipse.org/c/sourceediting/webtools.sourceediting.git/commit/?id=9644d4217cd6e3be367d654a8320104d88ddfd6b
Issue fixed along when packaging 3.18 upstream version as in the Debian
source (re)packaging the DTDParser.java and DTDValidator.java were removed.