Lucene search

K

GoogleOSV:CVE-2024-28757

HistoryMar 10, 2024 - 5:15 a.m.

CVE-2024-28757

2024-03-1005:15:06

Google

osv.dev

20

libexpat

xml

entity expansion

attack

external parsers

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.1%

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CPENameOperatorVersion
libexpateqREC1_0
expateq2.6.0-r1
expateq2.2.7-r1
expateq2.2.6-r0
expateq2.4.7-r1
expateq2.0.1-r2
expateq2.6.1-r2
libexpateqbeta4
expateq2.4.3-r0
expateq2.4.4-r0

Rows per page:

1-10 of 1101

References

www.openwall.com/lists/oss-security/2024/03/15/1

github.com/libexpat/libexpat/issues/839

github.com/libexpat/libexpat/pull/842

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/

security.netapp.com/advisory/ntap-20240322-0001/

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.1%

Related for OSV:CVE-2024-28757

nessus10 slackware1 openvas8 githubexploit3 redhatcve1 debiancve1 cve1 fedora3 ubuntucve1 f51 cbl_mariner1 cvelist1 alpinelinux1 veracode1 redos1 cloudfoundry1 redhat3 mageia1 oraclelinux1 almalinux1 osv2 ubuntu1 ibm5