Bug 1956522 (CVE-2021-3537) - CVE-2021-3537 libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode
Summary: CVE-2021-3537 libxml2: NULL pointer dereference when post-validating mixed co...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3537
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1956525 1956528 (view as bug list)
Depends On: 1962063 1956523 1956524 1957282 1957283 1957284 1957285 1962055 1962057 1962058 1962059 1962060 1962061 1962064 1962065
Blocks: 1956531 1957460
TreeView+ depends on / blocked
 
Reported: 2021-05-03 20:32 UTC by Pedro Sampaio
Modified: 2023-09-23 18:20 UTC (History)
20 users (show)

Fixed In Version: libxml2 2.9.11
Doc Type: If docs needed, set a value
Doc Text:
A NULL pointer dereference flaw was found in libxml2, where it did not propagate errors while parsing XML mixed content. This flaw causes the application to crash if an untrusted XML document is parsed in recovery mode and post validated. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-06-29 16:41:20 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2569 0 None None None 2021-06-29 16:27:53 UTC
Red Hat Product Errata RHSA-2022:1389 0 None None None 2022-04-20 19:42:09 UTC
Red Hat Product Errata RHSA-2022:1390 0 None None None 2022-04-20 19:30:35 UTC

Description Pedro Sampaio 2021-05-03 20:32:55 UTC 
Parsing specially crafted Mixed Content while parsing XML data may lead to invalid data structure being created, as errors were not propagated. This could lead to several NULL Pointer Dereference when post-validating documents parsed in recovery mode. 



References:

https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
https://gitlab.gnome.org/GNOME/libxml2/-/issues/244
https://gitlab.gnome.org/GNOME/libxml2/-/issues/245

Upstream fix:

https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61
Comment 1 Pedro Sampaio 2021-05-03 20:33:33 UTC 
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1956524]


Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1956523]
Comment 3 Cedric Buissart 2021-05-05 11:23:34 UTC 
*** Bug 1956525 has been marked as a duplicate of this bug. ***
Comment 4 Cedric Buissart 2021-05-05 11:24:00 UTC 
*** Bug 1956528 has been marked as a duplicate of this bug. ***
Comment 6 Cedric Buissart 2021-05-05 14:21:20 UTC 
Acknowledgments:

Name: yuawn (NSLab NTU Taiwan)
Comment 9 Cedric Buissart 2021-05-06 07:54:36 UTC 
Statement:

For the flaw to be exploitable, the document must be parsed in recovery mode and postvalidated (e.g.: when used in the `xmlling` tool, both `-recover` and `-postvalid` options must be used for the flaw to be exploitable)
Comment 11 errata-xmlrpc 2021-06-29 16:27:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:2569 https://access.redhat.com/errata/RHSA-2021:2569
Comment 12 Product Security DevOps Team 2021-06-29 16:41:20 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3537
Comment 13 errata-xmlrpc 2022-04-20 19:30:33 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2022:1390 https://access.redhat.com/errata/RHSA-2022:1390
Comment 14 errata-xmlrpc 2022-04-20 19:42:07 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2022:1389 https://access.redhat.com/errata/RHSA-2022:1389
Note You need to log in before you can comment on or make changes to this bug.