[GHSA-fj2m-w3wv-x9pr] Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack

[levpachmanov]

Updates

• Affected products

Comments

Summary

CVE-2022-39135 is an XML External Entity (XXE) vulnerability in Apache Calcite. A crafted SQL query can read local files (and reach internal network resources) through four SQL operators that parse XML without disabling Document Type Declarations / external entity resolution:

• EXISTS_NODE
• EXTRACT_XML
• XML_TRANSFORM
• EXTRACT_VALUE

All four are implemented in the class org.apache.calcite.runtime.XmlFunctions. The fix (1.32.0) hardens that class to use a secure DocumentBuilderFactory / TransformerFactory with DTDs and external entities disabled.

Why 1.19.0 is not affected

The vulnerable code did not exist when 1.19.0 was released. The class XmlFunctions.java — which contains all four affected operators — was added to Calcite's main branch ~9 months after 1.19.0 shipped, and first appeared in a release in 1.22.0.

Event	Date	Reference
calcite-1.19.0 released	2019-03-20	tag calcite-1.19.0
XmlFunctions.java introduced	2019-12-11	commit 1ddc1c3a0c61 — [CALCITE-3552] MySQL ExtractValue

The vulnerable class was created ~9 months after 1.19.0 was released, so 1.19.0 has no XML-parsing attack surface. This is consistent with NVD's affected range of 1.22.0 → 1.31.x (1.22.0 being the first release that shipped the class). 1.19.0 is therefore not applicable.

Source code references

• 1.19.0 source tree (confirm XmlFunctions.java is absent):
  https://github.com/apache/calcite/tree/calcite-1.19.0/core/src/main/java/org/apache/calcite/runtime
• First (vulnerable) appearance of the class in 1.22.0:
  https://github.com/apache/calcite/blob/calcite-1.22.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
• Last vulnerable version (1.31.0):
  https://github.com/apache/calcite/blob/calcite-1.31.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java
• Fixed version (1.32.0):
  https://github.com/apache/calcite/blob/calcite-1.32.0/core/src/main/java/org/apache/calcite/runtime/XmlFunctions.java

Fixing commit

• Commit: ba80b9156afc0db26b194d97a031fcc0dc7f4c03
  — "[CALCITE-5263] Improve XmlFunctions by using an XML DocumentBuilder"
• Jira: CALCITE-5263
• Release notes: Apache Calcite 1.32.0

Vulnerability databases

Database	Stated affected range	Covers 1.19.0?
NVD	1.22.0 → 1.31.x (i.e. [1.22.0, 1.32.0))	No ✅
Snyk	[1.22.0, 1.32.0)	No ✅
GitHub Advisory (GHSA-fj2m-w3wv-x9pr)	< 1.32.0 (no lower bound)	Yes — but this is overly broad ⚠️
MITRE	Mirrors NVD	No ✅