CVE-2018-20843 - 漏洞详情

CVE-2018-20843 (CNNVD-201906-908)

HIGH

中文标题:

libexpat 代码问题漏洞

英文标题:

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colo...

CVSS分数: 7.5

发布时间: 2019-06-24 16:06:38

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

libexpat是一款使用C语言编写的流式XML解析器。 libexpat 2.2.7之前版本中的libexpat存在代码问题漏洞。攻击者可借助XML名称中带有大量冒号的XML输入利用该漏洞造成拒绝服务（消耗大量RAM及CPU资源）。

英文描述:

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

CWE类型:

CWE-611

受影响产品

厂商	产品	版本	版本范围	平台	CPE
libexpat_project	libexpat	*	-	-	`cpe:2.3:a:libexpat_project:libexpat::::::::`
canonical	ubuntu_linux	12.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::`
canonical	ubuntu_linux	14.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`
canonical	ubuntu_linux	16.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::`
canonical	ubuntu_linux	18.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::`
canonical	ubuntu_linux	18.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*`
canonical	ubuntu_linux	19.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
fedoraproject	fedora	29	-	-	`cpe:2.3:o:fedoraproject:fedora:29:::::::*`
fedoraproject	fedora	30	-	-	`cpe:2.3:o:fedoraproject:fedora:30:::::::*`
opensuse	leap	15.0	-	-	`cpe:2.3:o:opensuse:leap:15.0:::::::*`
opensuse	leap	15.1	-	-	`cpe:2.3:o:opensuse:leap:15.1:::::::*`
oracle	hospitality_res_3700	*	-	-	`cpe:2.3:a:oracle:hospitality_res_3700::::::::`
oracle	http_server	12.1.3.0	-	-	`cpe:2.3:a:oracle:http_server:12.1.3.0:::::::*`
oracle	http_server	12.2.1.4.0	-	-	`cpe:2.3:a:oracle:http_server:12.2.1.4.0:::::::*`
oracle	outside_in_technology	8.5.4	-	-	`cpe:2.3:a:oracle:outside_in_technology:8.5.4:::::::*`
oracle	outside_in_technology	8.5.5	-	-	`cpe:2.3:a:oracle:outside_in_technology:8.5.5:::::::*`
tenable	nessus	*	-	-	`cpe:2.3:a:tenable:nessus::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

USN-4040-1 vendor-advisory
cve.org

访问

USN-4040-2 vendor-advisory
cve.org

访问

DSA-4472 vendor-advisory
cve.org

访问

20190628 [SECURITY] [DSA 4472-1] expat security update mailing-list
cve.org

访问

[debian-lts-announce] 20190629 [SECURITY] [DLA 1839-1] expat security update mailing-list
cve.org

访问

FEDORA-2019-18868e1715 vendor-advisory
cve.org

访问

FEDORA-2019-139fcda84d vendor-advisory
cve.org

访问

openSUSE-SU-2019:1777 vendor-advisory
cve.org

访问

GLSA-201911-08 vendor-advisory
cve.org

访问