Bug 2142450 (CVE-2022-39353)

Summary:	CVE-2022-39353 xmldom: Allows multiple root elements in a DOM tree
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the xmldom package. The xmldom parses XML that is not well-formed because it contains multiple top-level elements, adding all root nodes to the `childNodes` collection of the `Document` without reporting errors or throwing. This breaks the assumption that there is only a single root node in the tree, which led to CVE-2022-39299, as it is a potential issue for dependents.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2142451, 2142452
Bug Blocks:	2139602

Description Avinash Hanwate 2022-11-14 03:50:30 UTC

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

https://github.com/jindw/xmldom/issues/150
https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883

Comment 1 Avinash Hanwate 2022-11-14 03:50:58 UTC

Created breeze-icon-theme tracking bugs for this issue:

Affects: epel-all [bug 2142451]
Affects: fedora-all [bug 2142452]