CVE-2021-4249: xml-conduit unbounded entity expansion
Summary
CVE-2021-4249: xml-conduit unbounded entity expansion. Affects xml-conduit versions >= 0.5.0, < 1.9.1.0. Fixed in 1.9.1.0. How to fix ↓
Also tracked for
- haskell-xml-conduit · Debian:11
The same CVE-2021-4249 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xml-conduit package is a Haskell library that provides a simple and efficient way to parse and generate XML documents. It is commonly used for XML processing tasks in Haskell applications. However, a vulnerability has been discovered in the DOCTYPE Entity Expansion Handler of xml-conduit, which can lead to an infinite loop when processing unbounded entity expansions. This vulnerability can be exploited remotely.
Vulnerability Detail
The vulnerability in xml-conduit arises from an unknown function in the file xml-conduit/src/Text/XML/Stream/Parse.hs. By manipulating the XML input, an attacker can trigger an infinite loop in the entity expansion process. This can result in resource exhaustion and denial of service attacks. The vulnerability has been assigned a CVSSv3 score of 7.5 (High severity). Upgrading to version 1.9.1.0 of xml-conduit resolves this issue.
How To Fix
Minimum fixed version
1.9.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The xml-conduit package is vulnerable to an unbounded entity expansion issue, which can be exploited remotely to cause denial of service attacks. Upgrading to version 1.9.1.0 of xml-conduit is recommended to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xml-conduit →
FAQ
xml-conduit is a Haskell library for parsing and generating XML documents. It provides an efficient and easy-to-use interface for XML processing tasks.
The vulnerability in xml-conduit can lead to resource exhaustion and denial of service attacks. An attacker can exploit this vulnerability remotely to cause an infinite loop in the entity expansion process.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is recommended to upgrade the xml-conduit package to the fixed version (1.9.1.0) to mitigate the issue.
You can find more information about this vulnerability in the security advisory generated by Haskell's security advisories database. The advisory can be accessed at: [link to the advisory]
