Lucene search

RedhatCVE-2012-0876

HistoryJul 03, 2012 - 7:55 p.m.

CVE-2012-0876

2012-07-0319:55:02

CWE-400

redhat

web.nvd.nist.gov

201

xml parser

expat

hash collisions

denial of service

cve-2012-0876

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

7.4

Confidence

High

EPSS

0.004

Percentile

74.2%

JSON

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Affected configurations

Nvd

Node

libexpat_projectlibexpatRange<2.1.0

Node

pythonpythonRange2.6.0–2.6.8

pythonpythonRange2.7.0–2.7.3

pythonpythonRange3.1.0–3.1.5

pythonpythonRange3.2.0–3.2.3

Node

debiandebian_linuxMatch6.0

debiandebian_linuxMatch7.0

Node

canonicalubuntu_linuxMatch8.04-

canonicalubuntu_linuxMatch10.04-

canonicalubuntu_linuxMatch11.04

canonicalubuntu_linuxMatch11.10

canonicalubuntu_linuxMatch12.04-

Node

oraclesolarisMatch11.3

Node

redhatstorageMatch2.0

redhatenterprise_linux_desktopMatch5.0

redhatenterprise_linux_desktopMatch6.0

redhatenterprise_linux_eusMatch6.2

redhatenterprise_linux_serverMatch5.0

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_server_ausMatch6.2

redhatenterprise_linux_workstationMatch5.0

redhatenterprise_linux_workstationMatch6.0

VendorProductVersionCPE
libexpat_projectlibexpat*cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
debiandebian_linux6.0cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
canonicalubuntu_linux8.04cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
canonicalubuntu_linux10.04cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
canonicalubuntu_linux11.04cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
canonicalubuntu_linux11.10cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
canonicalubuntu_linux12.04cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
oraclesolaris11.3cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libexpat_project	libexpat	*	cpe:2.3:a:libexpat_project:libexpat::::::::
python	python	*	cpe:2.3:a:python:python::::::::
debian	debian_linux	6.0	cpe:2.3:o:debian:debian_linux:6.0:::::::*
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*
canonical	ubuntu_linux	8.04	cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::
canonical	ubuntu_linux	10.04	cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
canonical	ubuntu_linux	11.04	cpe:2.3:o:canonical:ubuntu_linux:11.04:::::::*
canonical	ubuntu_linux	11.10	cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
canonical	ubuntu_linux	12.04	cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::
oracle	solaris	11.3	cpe:2.3:o:oracle:solaris:11.3:::::::*