Bug 1954232 (CVE-2021-3517)

Summary:	CVE-2021-3517 libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	csutherl, dking, erik-fedora, fedora, gzaronik, igor.raits, jclere, jorton, jwon, kaycoth, krathod, ktietz, mturk, ohudlick, pjindal, rh-spice-bugs, rjones, szappis, tkorbar, veillard, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libxml2 2.9.11	Doc Type:	If docs needed, set a value
Doc Text:	There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-29 16:41:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1954233, 1954234, 1956999, 1957000, 1957001, 1957002
Bug Blocks:	1952638, 1954253

Description Guilherme de Almeida Suckevicz 2021-04-27 18:54:09 UTC

A heap-based buffer overflow was found in libxml2 when processing truncated UTF-8 input.

Reference:
https://gitlab.gnome.org/GNOME/libxml2/-/issues/235

Upstream patch:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2

Comment 1 Guilherme de Almeida Suckevicz 2021-04-27 18:54:40 UTC

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1954234]


Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1954233]

Comment 3 Guilherme de Almeida Suckevicz 2021-04-30 12:36:44 UTC

Acknowledgments:

Name: zodf0055980 (SQLab NCTU Taiwan)

Comment 6 Todd Cullum 2021-05-04 20:16:55 UTC

Upstream patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2

Comment 7 Todd Cullum 2021-05-04 22:22:27 UTC

Statement:

This flaw is out of support scope for Red Hat Enterprise Linux 6 and 7. To learn more about Red Hat Enterprise Linux support life cycles, please see https://access.redhat.com/support/policy/updates/errata .

Comment 8 errata-xmlrpc 2021-06-29 16:27:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2569 https://access.redhat.com/errata/RHSA-2021:2569

Comment 9 Product Security DevOps Team 2021-06-29 16:41:02 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3517

Comment 10 errata-xmlrpc 2022-04-20 19:30:28 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2022:1390 https://access.redhat.com/errata/RHSA-2022:1390

Comment 11 errata-xmlrpc 2022-04-20 19:41:57 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2022:1389 https://access.redhat.com/errata/RHSA-2022:1389