Denial of Service Vulnerability in libxml2: Remote Attack via XML Document
Summary
ALPINE-CVE-2017-5969: libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. Affects libxml2 versions < 2.9.4-r4. Fixed in 2.9.4-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML documents. It is known for its performance and compliance with various XML standards. However, it has a vulnerability that can be exploited when used in recover mode, which is intended for manual recovery of XML documents. This mode can lead to security issues if not handled properly, making it susceptible to crafted XML documents that can cause denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2017-5969 in libxml2 version 2.9.4 allows remote attackers to exploit the recover mode of the library. By sending a specially crafted XML document, an attacker can trigger a NULL pointer dereference, leading to a denial of service condition. This vulnerability arises from improper handling of XML parsing in recover mode, which should only be used for manual recovery. The CVSS score for this vulnerability is 4.7, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.9.4-r4
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the recover mode when parsing XML documents to mitigate the risk of exploitation. This can be done by ensuring that your application does not invoke the recover mode functionality.
Conclusion
In summary, CVE-2017-5969 is a denial of service vulnerability in libxml2 that can be exploited through crafted XML documents in recover mode. It is crucial to update to the patched version or disable recover mode to mitigate risks associated with this vulnerability.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2017-5969 is a vulnerability in libxml2 that allows remote attackers to cause a denial of service via a crafted XML document when the library is used in recover mode.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.7, indicating a moderate severity level.
If you cannot update libxml2, ensure that recover mode is disabled in your application to mitigate the risk of exploitation.
The potential impact of this vulnerability is a denial of service, which can disrupt the availability of applications relying on libxml2 for XML processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
