I am analyzing CVE-2022-0839.
When checking the commit, I don't understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn't the fix be done in the guilty class?
-
The POC link explains: "The XMLChangeLogSAXParser() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks. " It has a link to the line in the code and when that code is called. That's quite a lot of info...– schroeder ♦Jul 21, 2022 at 14:16
-
The actual question you ask is about the patch and why it is on the test class, so I refined your question to that, rather than a general complaint that there is not enough info.– schroeder ♦Jul 21, 2022 at 14:19
-
ok great thank you, yes you have a point in first, comment, but for the fact that the fix is in test class is very confusing!– ethicalhackerJul 21, 2022 at 14:22
-
I just found a conflict, on NVD website they put this as the fix commit: github.com/liquibase/liquibase/commit/… while on Snyk website, they put this as the fix commit: github.com/liquibase/liquibase/pull/2384/commits/…– ethicalhackerJul 21, 2022 at 14:25
Add a comment
|
1 Answer
Because the fix was already released before the vulnerability was published.
The CVE was for versions before 4.8. But 4.8 came out a week before the CVE was published.
So, there is no point in fixing what was fixed. The question is: why was this commit used in the CVE when it doesn't seem relevant?
It's because it is that test that this vulnerability was fixed.
Or the link in the CVE is wrong
answered Jul 21, 2022 at 14:26
