Critical XXE Vulnerability in libxml2: Exploitable SAX Parser Flaw
Summary
UBUNTU-CVE-2024-40896: In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). Affects libxml2 versions < 2.12.7+dfsg-3ubuntu0.1. Fixed in 2.12.7+dfsg-3ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a variety of functionalities for processing XML documents. It is known for its performance and compliance with standards, making it a popular choice in many applications. However, certain versions of libxml2 are vulnerable to an XML External Entity (XXE) attack, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability exists in libxml2 versions 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, where the SAX parser can produce events for external entities despite custom SAX handlers attempting to override entity content. This flaw allows attackers to exploit XXE attacks, potentially leading to data exposure and system compromise. The vulnerability has a CVSS score of 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.12.7+dfsg-3ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of external entities in your XML processing if possible. This can be done by configuring your SAX parser settings to ignore external entities, thus mitigating the risk until the package is updated.
Conclusion
The libxml2 package has a critical vulnerability that allows for XXE attacks due to flaws in its SAX parser. It is essential to update to the patched version to secure your applications and prevent potential data breaches. Utilize tools like Vulert to monitor your software for vulnerabilities effectively.
See every vulnerability recorded for libxml2 →
FAQ
An XML External Entity (XXE) attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data. It can lead to data exposure and system compromise.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
Failure to address this vulnerability may result in unauthorized access to sensitive data, data breaches, and potential system compromise.
Yes, you can temporarily disable the use of external entities in your XML processing to reduce the risk of exploitation until you can apply the patch.
Detailed information about this vulnerability can be found in the Ubuntu Security Notices and on the official libxml2 documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
