XML Entity Expansion Vulnerability in Expat Package
Summary
DEBIAN-CVE-2024-28757: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). Affects expat versions < 2.6.1-2. Fixed in 2.6.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat is an XML parser library written in C, designed to provide a fast and efficient way to parse XML documents. It is widely used in various applications due to its lightweight nature and ease of integration. However, the library has been found to be vulnerable to an XML Entity Expansion attack, particularly when external parsers are used in isolation. This vulnerability can lead to denial of service or other unintended consequences if exploited.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-28757 affects libexpat versions up to 2.6.1. It allows attackers to perform XML Entity Expansion attacks when external parsers are created using the XML_ExternalEntityParserCreate function. This can lead to excessive memory consumption and potential denial of service, as the parser may attempt to process an unbounded number of entities, overwhelming system resources.
How To Fix
Minimum fixed version
2.6.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using external parsers created via XML_ExternalEntityParserCreate until the package is updated. This can help mitigate the risk of exploitation while waiting for a proper fix.
Conclusion
The Expat package has a critical vulnerability that can lead to serious issues if not addressed. It is essential to update to the patched version 2.6.1-2 to protect your systems. Additionally, users should consider using workarounds until they can apply the necessary updates.
See every vulnerability recorded for expat →
FAQ
The vulnerability is an XML Entity Expansion attack that can lead to denial of service due to excessive resource consumption.
The vulnerability affects Expat versions up to 2.6.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, avoid using external parsers created via XML_ExternalEntityParserCreate as a temporary workaround.
For more information on vulnerabilities, you can visit Vulert, which monitors and alerts for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for expat.
