In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. https://github.com/libexpat/libexpat/pull/558 http://www.openwall.com/lists/oss-security/2022/02/19/1
Created expat tracking bugs for this issue: Affects: fedora-all [bug 2056351] Created mingw-expat tracking bugs for this issue: Affects: fedora-all [bug 2056352]
Upstream commit: https://github.com/libexpat/libexpat/commit/9b4ce651b26557f16103c3a366c91934ecd439ab
Created xmlrpc-c tracking bugs for this issue: Affects: fedora-all [bug 2057433]
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5244 https://access.redhat.com/errata/RHSA-2022:5244
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5314 https://access.redhat.com/errata/RHSA-2022:5314
This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2022:7144 https://access.redhat.com/errata/RHSA-2022:7144
This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services for RHEL 8 Via RHSA-2022:7143 https://access.redhat.com/errata/RHSA-2022:7143
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7811 https://access.redhat.com/errata/RHSA-2022:7811
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-25313