XML External Entity (XXE)

typo3/cms-core is vulnerable to XML external entities XXE. The vulnerability exists as the libxml object in getRssItems of RssWidget.php does not disable external entities...