CVE-2021-3541

Опубликовано: 09 июл. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950515
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0007/
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*

Версия до 2.9.11 (исключая)

Конфигурация 2

cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Конфигурация 12

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

EPSS

Процентиль: 23%

0.00076

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-776

Связанные уязвимости

CVE-2021-3541

CVSS3: 6.5

ubuntu

около 4 лет назад

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

CVE-2021-3541

CVSS3: 6.5

redhat

больше 4 лет назад

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

CVE-2021-3541

CVSS3: 6.5

debian

около 4 лет назад

A flaw was found in libxml2. Exponential entity expansion attack its p ...

openSUSE-SU-2021:1917-1

suse-cvrf

около 4 лет назад

Security update for libxml2

openSUSE-SU-2021:0886-1

suse-cvrf

около 4 лет назад

Security update for libxml2

EPSS

Процентиль: 23%

0.00076

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-776