Bug 2001671 (CVE-2019-20005, CVE-2019-20006, CVE-2019-20007, CVE-2019-20198, CVE-2019-20199, CVE-2019-20200, CVE-2019-20201, CVE-2019-20202, CVE-2021-26220, CVE-2021-26221, CVE-2021-26222, CVE-2021-30485, CVE-2021-31229, CVE-2021-31347, CVE-2021-31348, CVE-2021-31598)

Summary:	ezXML: multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dakingun, jspaleta, orion, pertusus, scitech-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-06 20:33:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2001673, 2001672
Bug Blocks:

Description Guilherme de Almeida Suckevicz 2021-09-06 17:32:55 UTC

Multiple security issues were found in ezXML which is bundled in netcdf.

CVE-2019-20005: https://sourceforge.net/p/ezxml/bugs/14/
CVE-2019-20006: https://sourceforge.net/p/ezxml/bugs/15/
CVE-2019-20007: https://sourceforge.net/p/ezxml/bugs/13/
CVE-2019-20198: https://sourceforge.net/p/ezxml/bugs/20/
CVE-2019-20199: https://sourceforge.net/p/ezxml/bugs/18/
CVE-2019-20200: https://sourceforge.net/p/ezxml/bugs/19/
CVE-2019-20201: https://sourceforge.net/p/ezxml/bugs/16/
CVE-2019-20202: https://sourceforge.net/p/ezxml/bugs/17/
CVE-2021-26220: https://sourceforge.net/p/ezxml/bugs/23/
CVE-2021-26221: https://sourceforge.net/p/ezxml/bugs/21/
CVE-2021-26222: https://sourceforge.net/p/ezxml/bugs/22/
CVE-2021-30485: https://sourceforge.net/p/ezxml/bugs/25/
CVE-2021-31229: https://sourceforge.net/p/ezxml/bugs/26/
CVE-2021-31348 / CVE-2021-31347: https://sourceforge.net/p/ezxml/bugs/27/
CVE-2021-31598: https://sourceforge.net/p/ezxml/bugs/28/

Comment 1 Guilherme de Almeida Suckevicz 2021-09-06 17:33:59 UTC

Created netcdf tracking bugs for this issue:

Affects: epel-all [bug 2001673]
Affects: fedora-all [bug 2001672]

Comment 2 Product Security DevOps Team 2021-09-06 20:33:21 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.