7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P
0.003 Low
EPSS
Percentile
65.6%
CentOS Errata and Security Advisory CESA-2017:2492
XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards “XML Digital Signature” and “XML Encryption”.
Security Fix(es):
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030963.html
Affected packages:
xmlsec1
xmlsec1-devel
xmlsec1-gcrypt
xmlsec1-gcrypt-devel
xmlsec1-gnutls
xmlsec1-gnutls-devel
xmlsec1-nss
xmlsec1-nss-devel
xmlsec1-openssl
xmlsec1-openssl-devel
Upstream details at:
https://access.redhat.com/errata/RHSA-2017:2492
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 7 | i686 | xmlsec1 | < 1.2.20-7.el7_4 | xmlsec1-1.2.20-7.el7_4.i686.rpm |
CentOS | 7 | x86_64 | xmlsec1 | < 1.2.20-7.el7_4 | xmlsec1-1.2.20-7.el7_4.x86_64.rpm |
CentOS | 7 | i686 | xmlsec1-devel | < 1.2.20-7.el7_4 | xmlsec1-devel-1.2.20-7.el7_4.i686.rpm |
CentOS | 7 | x86_64 | xmlsec1-devel | < 1.2.20-7.el7_4 | xmlsec1-devel-1.2.20-7.el7_4.x86_64.rpm |
CentOS | 7 | i686 | xmlsec1-gcrypt | < 1.2.20-7.el7_4 | xmlsec1-gcrypt-1.2.20-7.el7_4.i686.rpm |
CentOS | 7 | x86_64 | xmlsec1-gcrypt | < 1.2.20-7.el7_4 | xmlsec1-gcrypt-1.2.20-7.el7_4.x86_64.rpm |
CentOS | 7 | i686 | xmlsec1-gcrypt-devel | < 1.2.20-7.el7_4 | xmlsec1-gcrypt-devel-1.2.20-7.el7_4.i686.rpm |
CentOS | 7 | x86_64 | xmlsec1-gcrypt-devel | < 1.2.20-7.el7_4 | xmlsec1-gcrypt-devel-1.2.20-7.el7_4.x86_64.rpm |
CentOS | 7 | i686 | xmlsec1-gnutls | < 1.2.20-7.el7_4 | xmlsec1-gnutls-1.2.20-7.el7_4.i686.rpm |
CentOS | 7 | x86_64 | xmlsec1-gnutls | < 1.2.20-7.el7_4 | xmlsec1-gnutls-1.2.20-7.el7_4.x86_64.rpm |
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P
0.003 Low
EPSS
Percentile
65.6%