CVE-2021-45960
expat: Large number of prefixed XML attributes on a single tag can crash libexpat
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
En Expat (también se conoce como libexpat) versiones anteriores a 2.4.3, un desplazamiento a la izquierda por 29 (o más) lugares en la función storeAtts en el archivo xmlparse.c puede conllevar a un comportamiento incorrecto de reasignación (por ejemplo, asignar muy pocos bytes, o sólo liberar memoria).
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to buffer overrun. The highest threat from this vulnerability is to availability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-01-01 CVE Reserved
- 2022-01-01 CVE Published
- 2024-03-25 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-130: Improper Handling of Length Parameter Inconsistency
- CWE-682: Incorrect Calculation
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20220121-0004 | Third Party Advisory |
|
| https://www.tenable.com/security/tns-2022-05 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2022/01/17/3 | 2024-08-04 | |
| https://github.com/libexpat/libexpat/issues/531 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf | 2022-10-06 | |
| https://github.com/libexpat/libexpat/pull/534 | 2022-10-06 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202209-24 | 2022-10-06 | |
| https://www.debian.org/security/2022/dsa-5073 | 2022-10-06 | |
| https://access.redhat.com/security/cve/CVE-2021-45960 | 2022-10-26 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2044451 | 2022-10-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libexpat Project Search vendor "Libexpat Project" | Libexpat Search vendor "Libexpat Project" for product "Libexpat" | < 2.4.3 Search vendor "Libexpat Project" for product "Libexpat" and version " < 2.4.3" | - |
Affected
| ||||||
| Tenable Search vendor "Tenable" | Nessus Search vendor "Tenable" for product "Nessus" | < 8.15.3 Search vendor "Tenable" for product "Nessus" and version " < 8.15.3" | - |
Affected
| ||||||
| Tenable Search vendor "Tenable" | Nessus Search vendor "Tenable" for product "Nessus" | >= 10.0.0 < 10.1.1 Search vendor "Tenable" for product "Nessus" and version " >= 10.0.0 < 10.1.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Remote Connect Server Search vendor "Siemens" for product "Sinema Remote Connect Server" | < 3.1 Search vendor "Siemens" for product "Sinema Remote Connect Server" and version " < 3.1" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h610c Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h610c" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h610s Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h610s" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Hci Baseboard Management Controller Search vendor "Netapp" for product "Hci Baseboard Management Controller" | h615c Search vendor "Netapp" for product "Hci Baseboard Management Controller" and version "h615c" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Solidfire \& Hci Management Node Search vendor "Netapp" for product "Solidfire \& Hci Management Node" | - | - |
Affected
| ||||||