Expat Package Vulnerability: Stack Exhaustion via DTD Element Nesting
Summary
ALPINE-CVE-2022-25313: In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. Affects expat versions < 2.2.10-r2. Fixed in 2.2.10-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat, also known as libexpat, is a widely used XML parsing library that provides a fast and efficient way to parse XML documents. It is known for its simplicity and ease of integration into various applications. However, it has been identified that certain versions of Expat are vulnerable to a stack exhaustion issue when processing Document Type Definitions (DTDs) with excessive nesting, which can lead to application crashes or denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2022-25313, arises from the inability of Expat to handle deep nesting in DTD elements. An attacker can exploit this flaw by crafting a malicious XML document that contains a DTD with a large nesting depth. When the Expat parser attempts to process this document, it can lead to stack exhaustion, causing the application to crash or become unresponsive. This vulnerability affects multiple versions of the Expat library prior to version 2.4.5.
How To Fix
Minimum fixed version
2.2.10-r2
This is the first release that contains the fix.
sudo apk add --upgrade expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling DTD processing in your XML parser configuration, if supported. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The Expat package has a critical vulnerability that can lead to stack exhaustion through deep nesting in DTD elements. It is crucial to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for expat →
FAQ
CVE-2022-25313 is a vulnerability in the Expat XML parsing library that allows attackers to cause stack exhaustion through deep nesting in DTD elements.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or denial of service, impacting the availability of your application.
Yes, the vulnerability has been patched in Expat version 2.4.5 and later. It is recommended to update to this version or higher.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for expat.
