Bug 2056370 (CVE-2022-25236)

Summary: CVE-2022-25236 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abrt-devel-list, adudiak, aprice, arachman, bdettelb, caswilli, csutherl, dfreiber, dhalasz, doconnor, drow, erack, erik-fedora, fhrdina, fjansen, gotiwari, gzaronik, hkataria, jburrell, jclere, jhorak, jkoehler, jmitchel, jorton, jsamir, jtanner, jwong, jwon, kaycoth, kholdawa, kshier, lveyde, manisandro, michal.skrivanek, micjohns, mperina, mpierce, mturk, mvyas, nobody, oezr, omaciel, orabin, pjindal, plodge, psegedy, rcritten, rh-bugzilla, rh-spice-bugs, rjones, sbonazzo, stcannon, sthirugn, stransky, szappis, tcarlin, teagle, tfister, tkasparek, tkorbar, tpopela, tsasak, vkrizan, vkumar, vmugicag, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: expat 2.4.5 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in expat. Passing one or more namespace separator characters in the "xmlns[:prefix]" attribute values made expat send malformed tag names to the XML processor on top of expat. This issue causes arbitrary code execution depending on how unexpected cases are handled inside the XML processor.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2022-12-04 00:32:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2056371, 2056372, 2057008, 2057009, 2057010, 2057011, 2057012, 2057013, 2057014, 2057023, 2057323, 2057324, 2057429, 2058055, 2058056, 2058057, 2058058, 2058059, 2058060, 2058061, 2058062, 2058063, 2058064, 2058065, 2058066, 2058067, 2058068, 2058069, 2058070, 2058071, 2058072, 2058073, 2058074, 2058075, 2058076, 2058077, 2058078, 2058079, 2058080, 2058081, 2058082, 2058083, 2058084, 2058350, 2058353, 2064169, 2065579, 2065582, 2070468, 2072093    
Bug Blocks: 2056373    

Description Avinash Hanwate 2022-02-21 05:30:26 UTC 
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

http://www.openwall.com/lists/oss-security/2022/02/19/1
https://github.com/libexpat/libexpat/pull/561
Comment 1 Avinash Hanwate 2022-02-21 05:30:58 UTC 
Created expat tracking bugs for this issue:

Affects: fedora-all [bug 2056371]


Created mingw-expat tracking bugs for this issue:

Affects: fedora-all [bug 2056372]
Comment 4 Mauro Matteo Cascella 2022-02-22 15:18:17 UTC 
Upstream commit:
https://github.com/libexpat/libexpat/commit/a2fe525e660badd64b6c557c2b1ec26ddc07f6e4
Comment 7 Mauro Matteo Cascella 2022-02-23 11:51:31 UTC 
Created xmlrpc-c tracking bugs for this issue:

Affects: fedora-all [bug 2057429]
Comment 13 errata-xmlrpc 2022-03-10 15:06:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:0815 https://access.redhat.com/errata/RHSA-2022:0815
Comment 14 errata-xmlrpc 2022-03-10 15:14:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0816 https://access.redhat.com/errata/RHSA-2022:0816
Comment 15 errata-xmlrpc 2022-03-10 15:18:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0818 https://access.redhat.com/errata/RHSA-2022:0818
Comment 16 errata-xmlrpc 2022-03-10 15:24:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0817 https://access.redhat.com/errata/RHSA-2022:0817
Comment 17 errata-xmlrpc 2022-03-10 16:28:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:0824 https://access.redhat.com/errata/RHSA-2022:0824
Comment 18 errata-xmlrpc 2022-03-14 10:04:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0843 https://access.redhat.com/errata/RHSA-2022:0843
Comment 19 errata-xmlrpc 2022-03-14 10:07:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:0847 https://access.redhat.com/errata/RHSA-2022:0847
Comment 20 errata-xmlrpc 2022-03-14 10:13:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0845 https://access.redhat.com/errata/RHSA-2022:0845
Comment 21 errata-xmlrpc 2022-03-14 10:26:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0853 https://access.redhat.com/errata/RHSA-2022:0853
Comment 22 errata-xmlrpc 2022-03-14 10:44:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:0850 https://access.redhat.com/errata/RHSA-2022:0850
Comment 23 errata-xmlrpc 2022-03-16 16:17:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0951 https://access.redhat.com/errata/RHSA-2022:0951
Comment 24 Sandro Bonazzola 2022-03-18 09:18:18 UTC 
Created expat tracking bugs for this issue:

Affects: oVirt 4.4 [ bug 2065579 ]

Affects: CentOS Stream 8 [ bug 2065582 ]
Comment 25 errata-xmlrpc 2022-03-22 16:20:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:1012 https://access.redhat.com/errata/RHSA-2022:1012
Comment 26 errata-xmlrpc 2022-03-24 13:30:47 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2022:1053 https://access.redhat.com/errata/RHSA-2022:1053
Comment 27 errata-xmlrpc 2022-03-28 08:56:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:1068 https://access.redhat.com/errata/RHSA-2022:1068
Comment 28 errata-xmlrpc 2022-03-28 09:43:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:1070 https://access.redhat.com/errata/RHSA-2022:1070
Comment 29 errata-xmlrpc 2022-03-28 11:49:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:1069 https://access.redhat.com/errata/RHSA-2022:1069
Comment 31 errata-xmlrpc 2022-04-07 09:03:39 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2022:1263 https://access.redhat.com/errata/RHSA-2022:1263
Comment 32 errata-xmlrpc 2022-04-12 15:45:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2022:1309 https://access.redhat.com/errata/RHSA-2022:1309
Comment 33 errata-xmlrpc 2022-10-26 20:08:31 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2022:7144 https://access.redhat.com/errata/RHSA-2022:7144
Comment 34 errata-xmlrpc 2022-10-26 20:22:03 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2022:7143 https://access.redhat.com/errata/RHSA-2022:7143
Comment 36 errata-xmlrpc 2022-11-08 10:34:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7811 https://access.redhat.com/errata/RHSA-2022:7811
Comment 37 Product Security DevOps Team 2022-12-04 00:32:41 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-25236