xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service
CVSS Details
- CVSS 3.0 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade xmlsec1 | Sep 15, 2017 | Jul 17, 2017 |
| Centos_linux | — | Upgrade xmlsec1-gnutlsUpgrade xmlsec1-debuginfoUpgrade xmlsec1-nssUpgrade xmlsec1-develUpgrade xmlsec1-openssl-develUpgrade xmlsec1-gcrypt-develUpgrade xmlsec1-gcryptUpgrade xmlsec1-nss-develUpgrade xmlsec1-gnutls-develUpgrade xmlsec1Upgrade xmlsec1-openssl | Aug 28, 2019 | Jul 17, 2017 |
| Debian | — | Upgrade xmlsec1 | Jul 30, 2024 | Jul 17, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade xmlsec1Upgrade xmlsec1-openssl | Nov 30, 2017 | Jul 17, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade xmlsec1-opensslUpgrade xmlsec1 | Nov 30, 2017 | Jul 17, 2017 |
| Oracle_linux | — | Upgrade xmlsec1-gcrypt-develUpgrade xmlsec1-nssUpgrade xmlsec1-gcryptUpgrade xmlsec1-nss-develUpgrade xmlsec1-develUpgrade xmlsec1-openssl-develUpgrade xmlsec1Upgrade xmlsec1-opensslUpgrade xmlsec1-gnutls-develUpgrade xmlsec1-gnutls | Aug 21, 2017 | Mar 30, 2017 |
| Redhat_linux | — | Upgrade xmlsec1-gcrypt-develUpgrade xmlsec1-gcryptUpgrade xmlsec1-gnutlsUpgrade xmlsec1-nss-develUpgrade xmlsec1-gnutls-develUpgrade xmlsec1Upgrade xmlsec1-opensslUpgrade xmlsec1-debuginfoNo solution existsUpgrade xmlsec1-nssUpgrade xmlsec1-openssl-develUpgrade xmlsec1-devel | Aug 21, 2017 | Jul 17, 2017 |
| Ubuntu | — | Upgrade libxmlsec1 (Ubuntu Pro)Upgrade xmlsec1 (Ubuntu Pro) | Oct 14, 2022 | Jul 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub