Bug 2262877 (CVE-2023-52425) - CVE-2023-52425 expat: parsing large tokens can trigger a denial of service
Summary: CVE-2023-52425 expat: parsing large tokens can trigger a denial of service
Keywords:
Status: NEW
Alias: CVE-2023-52425
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2262882 2262884 2262883
Blocks: 2262876
TreeView+ depends on / blocked
 
Reported: 2024-02-05 23:27 UTC by Robb Gatica
Modified: 2024-10-25 12:38 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Expat (libexpat). When parsing a large token that requires multiple buffer fills to complete, Expat has to re-parse the token from start numerous times. This process may trigger excessive resource consumption, leading to a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:2943 0 None None None 2024-05-21 11:52:29 UTC
Red Hat Product Errata RHBA-2024:3941 0 None None None 2024-06-17 02:20:31 UTC
Red Hat Product Errata RHBA-2024:4068 0 None None None 2024-06-24 14:03:07 UTC
Red Hat Product Errata RHBA-2024:4637 0 None None None 2024-07-18 15:21:03 UTC
Red Hat Product Errata RHBA-2024:4712 0 None None None 2024-07-22 15:11:52 UTC
Red Hat Product Errata RHSA-2024:1530 0 None None None 2024-03-26 16:42:22 UTC
Red Hat Product Errata RHSA-2024:1615 0 None None None 2024-04-02 17:38:12 UTC
Red Hat Product Errata RHSA-2024:2575 0 None None None 2024-04-30 14:51:01 UTC
Red Hat Product Errata RHSA-2024:2839 0 None None None 2024-05-14 16:01:24 UTC
Red Hat Product Errata RHSA-2024:3926 0 None None None 2024-06-13 14:34:09 UTC
Red Hat Product Errata RHSA-2024:4259 0 None None None 2024-07-02 15:26:16 UTC

Description Robb Gatica 2024-02-05 23:27:26 UTC 
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

References:
[1] https://github.com/libexpat/libexpat/pull/789
[2] https://github.com/libexpat/libexpat/commit/34b598c5f594b015c513c73f06e7ced3323edbf1
Comment 1 Robb Gatica 2024-02-05 23:54:56 UTC 
Created expat tracking bugs for this issue:

Affects: fedora-all [bug 2262882]


Created mingw-expat tracking bugs for this issue:

Affects: fedora-all [bug 2262883]


Created xmlrpc-c tracking bugs for this issue:

Affects: fedora-all [bug 2262884]
Comment 8 errata-xmlrpc 2024-03-26 16:42:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:1530 https://access.redhat.com/errata/RHSA-2024:1530
Comment 10 errata-xmlrpc 2024-04-02 17:38:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:1615 https://access.redhat.com/errata/RHSA-2024:1615
Comment 13 errata-xmlrpc 2024-04-30 14:50:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:2575 https://access.redhat.com/errata/RHSA-2024:2575
Comment 14 errata-xmlrpc 2024-05-14 16:01:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:2839 https://access.redhat.com/errata/RHSA-2024:2839
Comment 15 errata-xmlrpc 2024-06-13 14:34:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3926 https://access.redhat.com/errata/RHSA-2024:3926
Comment 16 errata-xmlrpc 2024-07-02 15:26:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:4259 https://access.redhat.com/errata/RHSA-2024:4259
Note You need to log in before you can comment on or make changes to this bug.