GHSA-H6Q6-9HQW-RWFV中危已审查

Misinterpretation of malicious XML input

OSV 1.4.0 · github-reviewed · 修改于 2023-01-03 05:51

发布时间

2021-03-13 06:39

GitHub 审查时间

2021-03-13 00:21

NVD 发布时间

2021-03-13 01:15

源文件

advisories/github-reviewed/2021/03/GHSA-h6q6-9hqw-rwfv/GHSA-h6q6-9hqw-rwfv.json

公告说明

Impact

xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.

This may lead to unexpected syntactic changes during XML processing in some downstream applications.

Patches

Update to 0.5.0 (once it is released)

Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

References

Similar to this one reported on the Go standard library:

https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

For more information

If you have any questions or comments about this advisory:

Open an issue in xmldom/xmldom
Email us: send an email to all addresses that are shown by npm owner ls xmldom

受影响的软件包

标识信息

别名 / CVE

CVE-2021-21366

CWE

CWE-115CWE-436

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-h6q6-9hqw-rwfv",
  "aliases": [
    "CVE-2021-21366"
  ],
  "details": "### Impact\n\nxmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.\n\nThis may lead to unexpected syntactic changes during XML processing in some downstream applications.\n\n### Patches\n\nUpdate to 0.5.0 (once it is released)\n\n### Workarounds\n\nDownstream applications can validate the input and reject the maliciously crafted documents.\n\n### References\n\nSimilar to this one reported on the Go standard library:\n\n- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)\n* Email us: send an email to **all** addresses that are shown by `npm owner ls xmldom`",
  "summary": "Misinterpretation of malicious XML input",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0"
            }
          ]
        }
      ],
      "package": {
        "name": "xmldom",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2023-01-02T21:51:19Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
    }
  ],
  "published": "2021-03-12T22:39:39Z",
  "references": [
    {
      "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21366",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135",
      "type": "WEB"
    },
    {
      "url": "https://github.com/xmldom/xmldom",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/xmldom/xmldom/releases/tag/0.5.0",
      "type": "WEB"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/package/xmldom",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-115",
      "CWE-436"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2021-03-12T17:15:00Z",
    "github_reviewed_at": "2021-03-12T16:21:24Z"
  }
}