Remote XML Entity Inclusion Vulnerability in libxml2
Summary
CVE-2017-7375: A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Affects libxml2 across 4 version ranges.
< 2.9.4+dfsg1-3.1
< 8effcb578e0590cc01bbcab0f9dccefc6bdbcdbd
< a1dca81df7c352cd9a14ab678750b1623f8f8ed7
< bdec2183f34b37ee89ae1d330c6ad2bb4d76605f
Fixed in 2.9.4+dfsg1-3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML documents. It is known for its efficiency and is utilized in various applications and systems for XML manipulation. However, a flaw in its default parser settings can lead to serious security vulnerabilities, allowing unauthorized access to sensitive data.
Vulnerability Detail
CVE-2017-7375 is a vulnerability in libxml2 that allows remote XML entity inclusion when the default parser flags are used. This occurs when the caller does not explicitly request entity substitution, DTD validation, or external DTD subset loading. As a result, attackers may exploit this flaw to access local files or data from HTTP or FTP servers that would otherwise be protected. The vulnerability exposes a higher-risk attack surface that is typically not reachable under normal circumstances, potentially leading to data breaches or unauthorized information disclosure.
How To Fix
Minimum fixed version
2.9.4+dfsg1-3.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of external entities in your XML parsing configuration. This can be done by setting the appropriate parser options in your application code. For example, in C, you can use:
xmlParserCtxtPtr ctxt = xmlNewParserCtxt();
xmlCtxtSetParserFlags(ctxt, XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
Conclusion
CVE-2017-7375 presents a significant security risk for applications using libxml2 due to its potential for unauthorized data access. It is crucial to update to the latest version of the library and implement recommended security practices to mitigate this vulnerability.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2017-7375 is a vulnerability in the libxml2 library that allows remote XML entity inclusion due to improper parser settings.
Attackers can exploit this vulnerability to access sensitive data from local files or external servers by manipulating XML documents.
The consequences may include unauthorized data access, data breaches, and exposure of sensitive information.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2017-7375 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
