Checkstyle before 8.18 loads external DTDs by default.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Checkstyle before 8.18 loads external DTDs by default. (CVE-2019-9658)

Note that Nessus relies on the presence of the package as reported by the vendor.

checkstyle was loading external DTDs by default, which is now disabled by default.

If needed it can be re-enabled by setting the system property checkstyle.enableExternalDtdLoad to true.

For Debian 8 'Jessie', this problem has been fixed in version 5.9-1+deb8u1.

We recommend that you upgrade your checkstyle packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security vulnerability - Checkstyle loads external DTDs by default.

Upstream issue :

https://github.com/checkstyle/checkstyle/issues/6474 https://github.com/checkstyle/checkstyle/issues/6478

References :

https://checkstyle.org/releasenotes.html#Release_8.18

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
259076	Linux Distros Unpatched Vulnerability : CVE-2019-9658	Nessus	Misc.	medium
124341	Debian DLA-1768-1 : checkstyle security update	Nessus	Debian Local Security Checks	medium
124012	Fedora 29 : checkstyle (2019-e4405b4c9f)	Nessus	Fedora Local Security Checks	medium
124011	Fedora 28 : checkstyle (2019-a3f67e2364)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2019-9658

medium

Tenable Plugins

medium

medium

medium

medium