| Name | CVE-2019-13990 |
| Description | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 933169, 933170 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libquartz-java (PTS) | jessie | 1:1.7.3-5 | vulnerable |
| stretch | 1:1.8.6-3 | vulnerable |
| buster, bullseye | 1:1.8.6-6 | vulnerable |
| sid, trixie, bookworm | 1:1.8.6-8 | fixed |
| libquartz2-java (PTS) | stretch | 2.2.3-1 | vulnerable |
| buster | 2.3.0-2 | vulnerable |
| bullseye | 2.3.0-3 | fixed |
| sid, trixie, bookworm | 2.3.2-4 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bullseye] - libquartz-java <no-dsa> (Minor issue)
[buster] - libquartz-java <no-dsa> (Minor issue)
[stretch] - libquartz-java <no-dsa> (Minor issue)
[jessie] - libquartz-java <no-dsa> (Minor issue)
[buster] - libquartz2-java <no-dsa> (Minor issue)
[stretch] - libquartz2-java <no-dsa> (Minor issue)
https://github.com/quartz-scheduler/quartz/issues/467
https://github.com/quartz-scheduler/quartz/commit/a1395ba118df306c7fe67c24fb0c9a95a4473140