Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service due to [CVE-2023-34104]

Summary Node.js module fast-xml-parser is used by IBM App Connect Enterprise Certified Container for parsing XML. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to denial of service. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2023-26920]

Summary Node.js module fast-xml-parser is used by IBM App Connect Enterprise Certified Container for parsing XML data. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution. This bulletin...

Prototype Pollution

fast-xml-parser is vulnerable to Prototype Pollution. This vulnerability is due to not sanitizing user input or the proto field leading to polluting the global prototype object which can be used to mount denial of service DoS, RCE Remote Code Execution , Privilege Escalation Attacks...

@activepieces/piece-amazon-s3 (0.0.2), @adobe/helix-admin-support (>=2.1.22, <=2.1.23) +473 more potentially affected by unknown CVE via fast-xml-parser (4.2.4)

fast-xml-parser NPM version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-parser and may be impacted: - @activepieces/piece-amazon-s3 0.0.2 - @adobe/helix-admin-support =2.1.22, =9.0.39, =2.1.1, =2.1.15, =1.11.158, =1.0.4-0, =1.2.39-0,...

@activepieces/piece-amazon-s3 (0.0.2), @adobe/helix-admin-support (>=2.1.22, <=2.1.23) +473 more potentially affected by unknown CVE via fast-xml-parser (4.2.4)

fast-xml-parser NPM version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-parser and may be impacted: - @activepieces/piece-amazon-s3 0.0.2 - @adobe/helix-admin-support =2.1.22, =9.0.39, =2.1.1, =2.1.15, =1.11.158, =1.0.4-0, =1.2.39-0,...

@actvalue/av-aws-sdk (>=0.5.0, <=0.9.2), @adiza/sfpowerscripts (>=23.0.0, <=25.0.7) +617 more potentially affected by CVE-2021-26920 +1 more via fast-xml-parser (>=4.0.0-beta.2, <=4.1.1)

fast-xml-parser NPM version =4.0.0-beta.2, =0.5.0, =23.0.0, =35.0.0, =1.6.3, =7.1.3, =2.0.17, =1.2.11, =1.11.83, =8.3.11, =3.10.0, =3.0.0, =0.0.1-beta.1, =0.0.1-beta.1, =2.0.0, =10.8.0-RC.0, =10.12.0-RC.1 and more Source cves: CVE-2021-26920, CVE-2023-26920 Source advisory: OSV:GHSA-X3CC-X39P-42Q...

@actvalue/av-aws-sdk (>=0.5.0, <=0.9.2), @adiza/sfpowerscripts (>=23.0.0, <=25.0.7) +617 more potentially affected by CVE-2023-26920 via fast-xml-parser (>=4.0.0-beta.2, <=4.1.1)

fast-xml-parser NPM version =4.0.0-beta.2, =0.5.0, =23.0.0, =35.0.0, =1.6.3, =7.1.3, =2.0.17, =1.2.11, =1.11.83, =8.3.11, =3.10.0, =3.0.0, =0.0.1-beta.1, =0.0.1-beta.1, =2.0.0, =10.8.0-RC.0, =10.12.0-RC.1 and more Source cves: CVE-2023-26920 Source advisory: GHSA-X3CC-X39P-42QX...

GHSA-X3CC-X39P-42QX fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Impact As a part of this vulnerability, user was able to se code using proto as a tag or attribute name. js const XMLParser, XMLBuilder, XMLValidator = require"fast-xml-parser"; let XMLdata = "hacked" const parser = new XMLParser; let jObj = parser.parseXMLdata; console.logjObj.polluted // should...

Regular Expression Denial Of Service (ReDoS)

fast-xml-parser is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the readDocType function at DocTypeReader.js which allows an attacker to cause an application crash by submitting an entity name with bad preforming regex because entity names are not sanitize...

CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

Code injection

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

CVE-2023-34104

CVE-2023-34104 is a ReDoS vulnerability in the Natural Intelligence fast-xml-parser used by IBM Cloud Pak for Data (and related IBM products). The flaw arises from unescaped/sanitized special characters in entity names that are used to build a regex for entity replacement in DOCTYPE parsing, enab...

CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

CVE-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...

@aws-amplify/geo (>=2.0.13-push-notification-dryrun.43, <=2.0.35-unstable.3e5e6f9.1), @aws-amplify/interactions (>=5.0.13-push-notification-dryrun.43, <=5.1.1-unstable.3e5e6f9.1) +99 more potentially affected by CVE-2023-34104 via fast-xml-parser (>=4.1.3, <=4.2.3)

fast-xml-parser NPM version =4.1.3, =2.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =1.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =5.1.3-push-notification-dryrun.43, =1.1.6-exodus.1, =6.2.44, =9.1.0, =9.1.0, =9.53.0 and more Source cves:...

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an...

GHSA-6W63-H3FJ-Q4VW fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an...

@aws-amplify/geo (>=2.0.13-push-notification-dryrun.43, <=2.0.35-unstable.3e5e6f9.1), @aws-amplify/interactions (>=5.0.13-push-notification-dryrun.43, <=5.1.1-unstable.3e5e6f9.1) +99 more potentially affected by CVE-2023-34104 via fast-xml-parser (>=4.1.3, <=4.2.3)

fast-xml-parser NPM version =4.1.3, =2.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =1.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =5.1.3-push-notification-dryrun.43, =1.1.6-exodus.1, =6.2.44, =9.1.0, =9.1.0, =9.53.0 and more Source cves:...

@aws-amplify/geo (>=2.0.13-push-notification-dryrun.43, <=2.0.35-unstable.3e5e6f9.1), @aws-amplify/interactions (>=5.0.13-push-notification-dryrun.43, <=5.1.1-unstable.3e5e6f9.1) +99 more potentially affected by CVE-2023-34104 via fast-xml-parser (>=4.1.3, <=4.2.3)

fast-xml-parser NPM version =4.1.3, =2.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =1.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =5.1.3-push-notification-dryrun.43, =1.1.6-exodus.1, =6.2.44, =9.1.0, =9.1.0, =9.53.0 and more Source cves:...

CVE-2023-34104: Uncontrolled Resource Consumption

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denia...