CVE-2013-0340
Description
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
How to fix
- libexpat_project libexpat2.4.0 or later
- python python3.6.15, 3.7.12, 3.8.12, 3.9.7 or later
- apple ipados14.8 or later
- apple iphone_os14.8 or later
- apple macos11.6 or later
- apple tvos15.0 or later
- apple watchos8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libexpat_project libexpat | v < 2.4.0 | 2.4.0 |
| python python | 3.6.0 ≤ v < 3.6.15, 3.7.0 ≤ v < 3.7.12, 3.8.0 ≤ v < 3.8.12, 3.9.0 ≤ v < 3.9.7 | 3.6.15, 3.7.12, 3.8.12, 3.9.7 |
| apple ipados | v < 14.8 | 14.8 |
| apple iphone_os | v < 14.8 | 14.8 |
| apple macos | v < 11.6 | 11.6 |
| apple tvos | v < 15.0 | 15.0 |
| apple watchos | v < 8.0 | 8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.