XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.
Users are recommended to upgrade to version 1.21.2, which fixes this issue.
[
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.drill.contrib:drill-format-xml",
"product": "Apache Drill",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.21.2",
"status": "affected",
"version": "1.19.0",
"versionType": "semver"
}
]
}
]