Denial of Service Vulnerability in libxml2 and lxml Packages
Summary
DEBIAN-CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). Affects libxml2 versions < 2.9.10+dfsg-6.7+deb11u5. Fixed in 2.9.10+dfsg-6.7+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely-used XML parsing library that provides a range of functionalities for processing XML and HTML documents. It is known for its performance and compliance with standards. lxml is a Python binding for libxml2, allowing Python developers to leverage the capabilities of libxml2 in their applications. This vulnerability affects versions of libxml2 from 2.9.10 to 2.9.14, which can lead to application crashes when used with lxml under certain conditions.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2022-2309 is a NULL Pointer Dereference that allows attackers to cause a denial of service or application crash. This issue arises when the iterwalk function is used in conjunction with libxml2 versions 2.9.10 through 2.9.14. The vulnerability can be exploited by sending forged input data to applications that utilize this code sequence, potentially leading to crashes. It is important to note that libxml2 versions 2.9.9 and earlier are not affected by this issue.
How To Fix
Minimum fixed version
2.9.10+dfsg-6.7+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider avoiding the use of the iterwalk function with untrusted input. Instead, utilize the iterparse function, which is more efficient and does not expose the application to this vulnerability.
Conclusion
The DEBIAN-CVE-2022-2309 vulnerability poses a significant risk to applications using libxml2 and lxml, particularly when handling untrusted input. It is crucial to update to the patched versions of these packages to mitigate the risk of denial of service attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libxml2 →
FAQ
The vulnerability is a NULL Pointer Dereference that can lead to application crashes when specific functions are used with vulnerable versions of libxml2.
libxml2 versions 2.9.10 through 2.9.14 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
As a temporary measure, avoid using the iterwalk function with untrusted input and consider using the iterparse function instead.
While the primary risk is a denial of service, which can crash the application, there is no direct indication of data loss associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
