7.5Yüksek
CVE-2024-28757
Açıklama
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
Zayıflık türü (CWE):
CWE-776
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| fedoraproject | fedora | 38 | |
| libexpat project | libexpat | < 2.6.2 | |
| netapp | active iq unified manager | — | |
| netapp | h300s firmware | — | |
| netapp | h410c firmware | — | |
| netapp | h410s firmware | — | |
| netapp | h500s firmware | — | |
| netapp | h610c firmware | — | |
| netapp | h610s firmware | — | |
| netapp | h700s firmware | — | |
| netapp | oncommand workflow automation | — | |
| netapp | ontap | 9 | |
| netapp | ontap tools | 10 | |
| netapp | windows host utilities | — | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.0 – < V3.1.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.0 – < V3.1.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.0 – < V3.1.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.0 – < V3.1.5 | |
| Siemens | SINEC NMS | < V3.0 | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.0 – < V3.1.5 |
Kaynaklar ve yamalar
- https://github.com/libexpat/libexpat/pull/842 Issue TrackingPatch
- https://github.com/libexpat/libexpat/issues/839 ExploitIssue TrackingPatch
- FEDORA-2024-4e6e660fae vendor-advisoryMailing List
- FEDORA-2024-40b98c9ced vendor-advisoryMailing List
- https://security.netapp.com/advisory/ntap-20240322-0001/ Third Party Advisory
- FEDORA-2024-afb73e6f62 vendor-advisoryMailing List
- [oss-security] 20240315 Expat 2.6.2 released, includes security fixes mailing-listMailing ListPatchRelease Notes
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJ…
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHB…
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CPE eşleşmeleri (NVD) (16)
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*< 2.6.2cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:windows_host_utilities:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*