CVE-2021-45960
expat: Large number of prefixed XML attributes on a single tag can crash libexpat
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
En Expat (también se conoce como libexpat) versiones anteriores a 2.4.3, un desplazamiento a la izquierda por 29 (o más) lugares en la función storeAtts en el archivo xmlparse.c puede conllevar a un comportamiento incorrecto de reasignación (por ejemplo, asignar muy pocos bytes, o sólo liberar memoria).
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to buffer overrun. The highest threat from this vulnerability is to availability.
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, integer overflow, null pointer, out of bounds read, out of bounds write, and server-side request forgery vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-01 CVE Reserved
- 2022-01-01 CVE Published
- 2022-04-11 First Exploit
- 2024-08-04 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-130: Improper Handling of Length Parameter Inconsistency
- CWE-682: Incorrect Calculation
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20220121-0004 | Third Party Advisory |
|
| https://www.tenable.com/security/tns-2022-05 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf | 2022-10-06 | |
| https://github.com/libexpat/libexpat/pull/534 | 2022-10-06 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202209-24 | 2022-10-06 | |
| https://www.debian.org/security/2022/dsa-5073 | 2022-10-06 | |
| https://access.redhat.com/security/cve/CVE-2021-45960 | 2022-10-26 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2044451 | 2022-10-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libexpat Project Search vendor "Libexpat Project" | Libexpat Search vendor "Libexpat Project" for product "Libexpat" | < 2.4.3 Search vendor "Libexpat Project" for product "Libexpat" and version " < 2.4.3" | - |
Affected
| ||||||
| Tenable Search vendor "Tenable" | Nessus Search vendor "Tenable" for product "Nessus" | < 8.15.3 Search vendor "Tenable" for product "Nessus" and version " < 8.15.3" | - |
Affected
| ||||||
| Tenable Search vendor "Tenable" | Nessus Search vendor "Tenable" for product "Nessus" | >= 10.0.0 < 10.1.1 Search vendor "Tenable" for product "Nessus" and version " >= 10.0.0 < 10.1.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Remote Connect Server Search vendor "Siemens" for product "Sinema Remote Connect Server" | < 3.1 Search vendor "Siemens" for product "Sinema Remote Connect Server" and version " < 3.1" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h610c Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h610c" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h610s Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h610s" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h615c Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h615c" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Solidfire \& Hci Management Node Search vendor "Netapp" for product "Solidfire \& Hci Management Node" | - | - |
Affected
| ||||||