Описание
When an Expat parser with a registered ElementDeclHandler parses an inline
document type definition containing a deeply nested content model a C stack
overflow occurs.
A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash.
Отчет
This Moderate severity flaw in CPython's Expat parser can lead to a denial of service. The vulnerability occurs when an application using the Expat parser with a registered ElementDeclHandler processes an XML document containing a deeply nested Document Type Definition (DTD) content model. Exploitation requires specific conditions, making the attack complexity high.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3.11 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python39-devel:3.9/python39 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | python3.11 | Fix deferred | ||
| Red Hat Enterprise Linux 9 | python3.9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-aws-cuda-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
Stack overflow parsing XML with deeply nested DTD content models
When an Expat parser with a registered ElementDeclHandler parses an in ...
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
5.9 Medium
CVSS3