Ucum-java has an XXE vulnerability in XML parsing
ImpactXML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.PatchesRelease 1.0.9 of ucum fixes this vulnerabilityWorkaroundsEnsure that the source xml for instantiating UcumEssenceService is trusted.Referenceshttps://cwe.mitre.org/data/definitions/611.htmlhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j