Disallow loading of external DTD

Resolves CVE-2016-5002

xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch

@@ -1,7 +1,7 @@
 From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Fri, 18 May 2018 15:22:49 +0200
-Subject: [PATCH] Disallow deserialization of <ex:serializable> tags
+Subject: [PATCH 1/2] Disallow deserialization of <ex:serializable> tags
 
 Can be reenabled by setting JVM property
 org.apache.xmlrpc.allowInsecureDeserialization to 1.

xmlrpc-disallow-loading-external-dtd.patch

@@ -0,0 +1,30 @@
+From 338ab231b228bd36afda4ab31db724c6669579b2 Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Tue, 22 May 2018 10:53:28 +0200
+Subject: [PATCH 2/2] Disallow loading external DTD
+
+---
+ .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java   | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
+index b1034e7..49ef5de 100644
+--- a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
++++ b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
+@@ -48,6 +48,13 @@ public class SAXParsers {
+         } catch (org.xml.sax.SAXException e) {
+             // Ignore it
+ 		}
++        try {
++            spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
++        } catch (javax.xml.parsers.ParserConfigurationException e) {
++            // Ignore it
++        } catch (org.xml.sax.SAXException e) {
++            // Ignore it
++        }
+ 	}
+ 
+ 	/** Creates a new instance of {@link XMLReader}.
+-- 
+2.17.0
+

xmlrpc.spec

@@ -13,6 +13,7 @@ Patch1:         %{name}-common-addosgimanifest.patch
 Patch2:         %{name}-javax-methods.patch
 Patch3:         %{name}-server-addosgimanifest.patch
 Patch4:         %{name}-disallow-deserialization-of-ex-serializable-tags.patch
+Patch5:         %{name}-disallow-loading-external-dtd.patch
 
 BuildRequires:  maven-local
 BuildRequires:  mvn(org.apache:apache:pom:)
@@ -74,6 +75,7 @@ pushd server
 %patch3 -b .sav
 popd
 %patch4 -p1
+%patch5 -p1
 
 sed -i 's/\r//' LICENSE.txt
 
@@ -106,6 +108,8 @@ sed -i 's/\r//' LICENSE.txt
 * Fri May 18 2018 Michael Simacek <msimacek@redhat.com> - 1:3.1.3-20
 - Disallow deserialization of <ex:serializable> tags by default
 - Resolves CVE-2016-5003
+- Disallow loading of external DTD
+- Resolves CVE-2016-5002
 
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.1.3-19
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild