CVE-2021-3541 MEDIUM

Published: 2021-07-09 | Last Modified: 2024-11-21 | Status: Modified

Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Additional Descriptions (1)

Se ha encontrado un fallo en libxml2. Es posible un ataque de expansión exponencial de entidades omitiendo todos los mecanismos de protección existentes y conllevando a una denegación de servicio

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 4.0 (MEDIUM)

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-776

Affected Products

Vendor	Product	Version	Update	Type
xmlsoft	libxml2	*	<built-in method update of dict object at 0x72a9b0ca7000>	Application
redhat	jboss_core_services	-	<built-in method update of dict object at 0x72a9cdf17900>	Application
oracle	zfs_storage_appliance_kit	8.8	<built-in method update of dict object at 0x72a9a39c46c0>	Application
netapp	active_iq_unified_manager	-	<built-in method update of dict object at 0x72a9a39c5e40>	Application
netapp	cloud_backup	-	<built-in method update of dict object at 0x72a9b0ca5800>	Application
netapp	clustered_data_ontap	-	<built-in method update of dict object at 0x72a9b0ca5580>	Application
netapp	clustered_data_ontap_antivirus_connector	-	<built-in method update of dict object at 0x72a9cc833780>	Application
netapp	manageability_software_development_kit	-	<built-in method update of dict object at 0x72a9b0d2c640>	Application
netapp	ontap_select_deploy_administration_utility	-	<built-in method update of dict object at 0x72a9cdf17880>	Application
netapp	smi-s_provider	-	<built-in method update of dict object at 0x72a9b0d2c980>	Application
netapp	snapdrive	-	<built-in method update of dict object at 0x72a9b0d7ba00>	Application
netapp	h410c_firmware	-	<built-in method update of dict object at 0x72a9cc833700>	Operating System
netapp	h300s_firmware	-	<built-in method update of dict object at 0x72a9b0a4a380>	Operating System
netapp	h500s_firmware	-	<built-in method update of dict object at 0x72a9b0a49880>	Operating System
netapp	h700s_firmware	-	<built-in method update of dict object at 0x72a9b0b74c00>	Operating System
netapp	h300e_firmware	-	<built-in method update of dict object at 0x72a9b0c19740>	Operating System
netapp	h500e_firmware	-	<built-in method update of dict object at 0x72a9b0796740>	Operating System
netapp	h700e_firmware	-	<built-in method update of dict object at 0x72a9a31fdec0>	Operating System
netapp	h410s_firmware	-	<built-in method update of dict object at 0x72a9a39c6480>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:xmlsoft:libxml2::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:redhat:jboss_core_services:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::`
Yes	`cpe:2.3:a:netapp:cloud_backup:-:::::::*`
Yes	`cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*`
Yes	`cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:::::::*`
Yes	`cpe:2.3:a:netapp:manageability_software_development_kit:-:::::::*`
Yes	`cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*`
Yes	`cpe:2.3:a:netapp:smi-s_provider:-:::::::*`
Yes	`cpe:2.3:a:netapp:snapdrive:-:::::unix::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410c_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h300s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h300s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h500s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h500s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h700s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h700s:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h300e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h300e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h500e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h500e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h700e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h700e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:h410s_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:netapp:h410s:-:::::::*`

References

https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Source: [email protected]

Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Source: [email protected]

Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Source: [email protected]

Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Third Party Advisory