Bug 2142450 (CVE-2022-39353) - CVE-2022-39353 xmldom: Allows multiple root elements in a DOM tree
Summary: CVE-2022-39353 xmldom: Allows multiple root elements in a DOM tree
Keywords:
Status: NEW
Alias: CVE-2022-39353
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2142451 2142452
Blocks: 2139602
TreeView+ depends on / blocked
 
Reported: 2022-11-14 03:50 UTC by Avinash Hanwate
Modified: 2023-07-07 08:28 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the xmldom package. The xmldom parses XML that is not well-formed because it contains multiple top-level elements, adding all root nodes to the `childNodes` collection of the `Document` without reporting errors or throwing. This breaks the assumption that there is only a single root node in the tree, which led to CVE-2022-39299, as it is a potential issue for dependents.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-11-14 03:50:30 UTC 
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

https://github.com/jindw/xmldom/issues/150
https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883
Comment 1 Avinash Hanwate 2022-11-14 03:50:58 UTC 
Created breeze-icon-theme tracking bugs for this issue:

Affects: epel-all [bug 2142451]
Affects: fedora-all [bug 2142452]
Note You need to log in before you can comment on or make changes to this bug.