Описание
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
A flaw was found in xmldom. Two independent quadratic paths in the XML DOM (Document Object Model) parser can lead to a denial of service (DoS). A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and rebuild strings during normalization. This excessive processing consumes system resources, making the application unresponsive.
Отчет
Important: A denial of service flaw exists in the xmldom library due to quadratic-time processing of malformed XML input. This vulnerability can lead to excessive resource consumption and unresponsiveness in Red Hat products that parse untrusted XML, including OpenShift Container Platform, Red Hat JBoss Fuse, Red Hat OpenShift AI, Red Hat Build of Podman Desktop, Red Hat Developer Hub, Red Hat Enterprise Linux (Grafana), and Red Hat In-Vehicle OS.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Will not fix | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Affected | ||
| Red Hat Enterprise Linux 10 | grafana | Affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | grafana | Affected | ||
| Red Hat Fuse 7 | xmldom | Will not fix | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
(xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...
Уязвимость функции parseElementStartPart() файла lib/sax.js модуля определения способа доступа к документам XML и управления ими XMLDOM, позволяющая нарушителю вызвать отказ в обслуживании
7.5 High
CVSS3