Critical Memory Mismanagement in Expat Package - CVE-2021-45960
Summary
ALPINE-CVE-2021-45960: In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Affects expat versions < 2.2.10-r0. Fixed in 2.2.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat, also known as libexpat, is an XML parsing library widely used in various applications for its efficiency and ease of use. It provides a simple API for parsing XML documents and is known for its performance and low memory footprint. However, it has been identified to have a critical vulnerability that can lead to memory mismanagement, potentially affecting applications that rely on it.
Vulnerability Detail
In Expat (aka libexpat) before version 2.4.3, a left shift by 29 or more places in the storeAtts function within xmlparse.c can lead to realloc misbehavior. This misbehavior may result in allocating insufficient memory or improperly freeing memory, which can lead to application crashes or exploitation by attackers. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the affected functions in Expat until the package is updated. Review your application's XML parsing logic to ensure it does not rely on the vulnerable aspects of the library.
Conclusion
The vulnerability identified as CVE-2021-45960 in the Expat package poses a significant risk to applications that utilize this XML parsing library. It is crucial to update to the patched version to mitigate potential security threats. Utilize available resources like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for expat →
FAQ
CVE-2021-45960 is a vulnerability in the Expat XML parsing library that can lead to memory mismanagement.
If your application uses Expat versions prior to 2.4.3, it may be susceptible to crashes or exploitation due to improper memory handling.
Consider implementing a workaround by avoiding the use of the affected functions until you can update to a patched version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for expat.
