CVE-2018-20843
High
Description
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
SeverityHigh
CVSS7.5
Exploit probability—
Product
Libexpat
PublishedJun 24, 2019
First seenJun 24, 2019
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- libexpat_project libexpat2.2.7 or later
- tenable nessus8.15.0 or later
Vendor advisories
- usn.ubuntu.com/4040-1/
- usn.ubuntu.com/4040-2/
- debian.org/security/2019/dsa-4472
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/
- security.gentoo.org/glsa/201911-08
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libexpat_project libexpat | v < 2.2.7 | 2.2.7 |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04, 18.10, 19.04 | — |
| debian debian_linux | 8.0, 9.0 | — |
| fedoraproject fedora | 29, 30 | — |
| opensuse leap | 15.0, 15.1 | — |
| oracle hospitality_res_3700 | 5.7 ≤ v ≤ 5.7.6 | — |
| oracle http_server | 12.1.3.0, 12.2.1.4.0 | — |
| oracle outside_in_technology | 8.5.4, 8.5.5 | — |
| tenable nessus | v < 8.15.0 | 8.15.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.