CVE-2021-3541 MEDIUM

Published: 2021-07-09 | Last Modified: 2024-11-21 | Status: Modified

Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Additional Descriptions (1)

Se ha encontrado un fallo en libxml2. Es posible un ataque de expansión exponencial de entidades omitiendo todos los mecanismos de protección existentes y conllevando a una denegación de servicio

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-776

Affected Products

Vendor	Product	Version	Update	Type
xmlsoft	libxml2	*	<built-in method update of dict object at 0x7fd2d3949640>	Application
redhat	jboss_core_services	-	<built-in method update of dict object at 0x7fd38541c280>	Application
oracle	zfs_storage_appliance_kit	8.8	<built-in method update of dict object at 0x7fd36afa4b40>	Application
netapp	active_iq_unified_manager	-	<built-in method update of dict object at 0x7fd36afa52c0>	Application
netapp	cloud_backup	-	<built-in method update of dict object at 0x7fd38541ce80>	Application
netapp	clustered_data_ontap	-	<built-in method update of dict object at 0x7fd38541f380>	Application
netapp	clustered_data_ontap_antivirus_connector	-	<built-in method update of dict object at 0x7fd36afa5180>	Application
netapp	manageability_software_development_kit	-	<built-in method update of dict object at 0x7fd36afa6940>	Application
netapp	ontap_select_deploy_administration_utility	-	<built-in method update of dict object at 0x7fd2dbd50dc0>	Application
netapp	smi-s_provider	-	<built-in method update of dict object at 0x7fd370344a00>	Application
netapp	snapdrive	-	<built-in method update of dict object at 0x7fd38541d540>	Application
netapp	h410c_firmware	-	<built-in method update of dict object at 0x7fd39c4e8f00>	Operating System
netapp	h300s_firmware	-	<built-in method update of dict object at 0x7fd384a85dc0>	Operating System
netapp	h500s_firmware	-	<built-in method update of dict object at 0x7fd3855bfe00>	Operating System
netapp	h700s_firmware	-	<built-in method update of dict object at 0x7fd36afa49c0>	Operating System
netapp	h300e_firmware	-	<built-in method update of dict object at 0x7fd36afa6c00>	Operating System
netapp	h500e_firmware	-	<built-in method update of dict object at 0x7fd38541ffc0>	Operating System
netapp	h700e_firmware	-	<built-in method update of dict object at 0x7fd38541cbc0>	Operating System
netapp	h410s_firmware	-	<built-in method update of dict object at 0x7fd36afa7080>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:xmlsoft:libxml2::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:redhat:jboss_core_services:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::`
Yes	`cpe:2.3:a:netapp:cloud_backup:-:::::::*`
Yes	`cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*`
Yes	`cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:::::::*`
Yes	`cpe:2.3:a:netapp:manageability_software_development_kit:-:::::::*`
Yes	`cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*`
Yes	`cpe:2.3:a:netapp:smi-s_provider:-:::::::*`
Yes	`cpe:2.3:a:netapp:snapdrive:-:::::unix::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410c_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h300s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h300s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h500s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h500s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h700s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h700s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h300e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h300e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h500e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h500e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h700e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h700e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410s:-:::::::*`

References

https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Source: [email protected]

Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Source: [email protected]

Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Source: [email protected]

Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Third Party Advisory