CVE-2017-9233CWE-611CWE-835xxe

CVE-2017-9233

High · published July 26, 2017

CVSS v3.1
7.5
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.08739 · 95.1th percentile
Weaknesses
CWE-611 · Improper Restriction of XML External Entity Reference; CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2017-07-26T00:29Z
Affected products (9)
ProductVersionsFixed in
libexpat_project/libexpat≤ 2.2.0—
python/python≥ 2.7.0, < 2.7.152.7.15
python/python≥ 3.3.0, < 3.3.73.3.7
python/python≥ 3.4.0, < 3.4.73.4.7
python/python≥ 3.5.0, < 3.5.43.5.4
python/python≥ 3.6.0, < 3.6.23.6.2
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (26)
http://www.debian.org/security/2017/dsa-3898 · [email protected]http://www.openwall.com/lists/oss-security/2017/06/17/7 · [email protected]http://www.securityfocus.com/bid/99276 · [email protected]http://www.securitytracker.com/id/1039427 · [email protected]https://github.com/libexpat/libexpat/blob/master/expat/Changes · [email protected]https://libexpat.github.io/doc/cve-2017-9233/ · [email protected]https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://support.apple.com/HT208112 · [email protected]https://support.apple.com/HT208113 · [email protected]https://support.apple.com/HT208115 · [email protected]https://support.apple.com/HT208144 · [email protected]https://support.f5.com/csp/article/K03244804 · [email protected]http://www.debian.org/security/2017/dsa-3898 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2017/06/17/7 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/99276 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1039427 · af854a3a-2127-422b-91ae-364da2661108https://github.com/libexpat/libexpat/blob/master/expat/Changes · af854a3a-2127-422b-91ae-364da2661108https://libexpat.github.io/doc/cve-2017-9233/ · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT208112 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT208113 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT208115 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/HT208144 · af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K03244804 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 JUL 20:00Z
    XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a…
    cvelistv5