Bug 1799786 (CVE-2020-7595) - CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations
Summary: CVE-2020-7595 libxml2: infinite loop in xmlStringLenDecodeEntities in some en...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-7595
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1799787 1799788 1799789 1810073 1810074 1810075 1921211 1921212 1921213
Blocks: 1799791
TreeView+ depends on / blocked
 
Reported: 2020-02-06 18:56 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-06-13 22:27 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-06-22 17:20:37 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2644 0 None None None 2020-06-22 12:26:56 UTC
Red Hat Product Errata RHSA-2020:2646 0 None None None 2020-06-22 13:08:54 UTC
Red Hat Product Errata RHSA-2020:3996 0 None None None 2020-09-29 20:27:11 UTC
Red Hat Product Errata RHSA-2020:4479 0 None None None 2020-11-04 01:20:54 UTC

Description Guilherme de Almeida Suckevicz 2020-02-06 18:56:46 UTC 
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Reference and upstream commit:
https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076
Comment 1 Guilherme de Almeida Suckevicz 2020-02-06 18:58:18 UTC 
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1799787]


Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1799789]
Affects: fedora-all [bug 1799788]
Comment 6 errata-xmlrpc 2020-06-22 12:26:53 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 6
  JBoss Core Services on RHEL 7

Via RHSA-2020:2644 https://access.redhat.com/errata/RHSA-2020:2644
Comment 7 errata-xmlrpc 2020-06-22 13:08:52 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2020:2646 https://access.redhat.com/errata/RHSA-2020:2646
Comment 8 Product Security DevOps Team 2020-06-22 17:20:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-7595
Comment 9 errata-xmlrpc 2020-09-29 20:27:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3996 https://access.redhat.com/errata/RHSA-2020:3996
Comment 10 errata-xmlrpc 2020-11-04 01:20:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4479 https://access.redhat.com/errata/RHSA-2020:4479
Comment 15 atrivizas 2023-04-12 12:15:05 UTC 
(In reply to errata-xmlrpc from comment #9)
> This issue has been addressed in the following products:
> 
>   Red Hat Enterprise Linux 7
> 
> Via RHSA-2020:3996 https://access.redhat.com/errata/RHSA-2020:3996

Is this fix valid for Red Hat Enterprise Linux 7.6 ?
Comment 16 Guilherme de Almeida Suckevicz 2023-04-14 17:43:39 UTC 
In reply to comment #15:
> Is this fix valid for Red Hat Enterprise Linux 7.6 ?

Hi, the fix of this issue is only valid for RHEL 7.9 and newer versions.
Note You need to log in before you can comment on or make changes to this bug.