Intellij jar й”Ѓ update#

When using the tool XSSFExportToXml to convert user-provided MicrosoftД®xcel documents, a specially crafted document can allow an attacker to XML external entity attack 20 October 2019 - CVE-2019-12415 - XML External Entity (XXE) Processing in Apache POI versions prior to 4.1.1

Intellij jar й”Ѓ update#

This issue was fixed a few years ago but on review, we decided we should have a CVEДЄffected users are advised to update to Apache XMLBeans 3.0.0 or above

When parsing XML files using XMLBeans 2.6.0 or below, the underlying parserД¬reated by XMLBeans could be susceptible to XML External Entity (XXE) attacks. 13 January 2021 - CVE-2021-23926 - XML External Entity (XXE) Processing in Apache XMLBeans versions prior to 3.0.0 Version (currently v2.17.1) - including log4j-api. We strongly recommend that they upgrade all their log4j dependencies to the latest If any POI or XMLBeans user uses log4j-core to control their logging of their application, The security vulnerabilities are not in log4j-api - they are in log4j-core. POI 5.1.0 and XMLBeans 5.0.2 only have dependencies on log4j-api 2.14.1. The Apache POI PMC has evaluated the security vulnerabilities reported POI requires Java 8 or newer since version 4.0.1. People interested should also follow the dev list to track progress. Several dependencies were updated to their latest versions to pick up security fixes and other improvements.ДЄ full list of changes is available in the change log. The Apache POI team is pleased to announce the release of 5.2.0.