CVE-2022-25235CWE-116

CVE-2022-25235

Critical · published February 16, 2022

CVSS v3.1
9.8
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

🚨 A sneaky encoding oversight in Expat could put your applications at risk! If a UTF-8 character isn't validated properly, it could lead to some serious chaos! 🔥 Think of it like a restaurant that serves a dish without checking if the ingredients are fresh. If you use spoiled ingredients, it could ruin the entire meal — just like invalid characters can mess up your XML parsing! Without proper encoding validation, an attacker could exploit this vulnerability to craft malicious XML input, potentially leading to crashes or unexpected behavior in your application. This could result in service disruptions, errors, or even data loss — an absolute nightmare for any developer! 💥

Put simply

Think of it like a restaurant that serves a dish without checking if the ingredients are fresh. If you use spoiled ingredients, it could ruin the entire meal — just like invalid characters can mess up your XML parsing! In Expat (libexpat) versions prior to 2.4.5, the xmltok_impl.c file fails to validate UTF-8 characters in certain contexts, which can lead to unexpected parsing issues.

What to do

Without proper encoding validation, an attacker could exploit this vulnerability to craft malicious XML input, potentially leading to crashes or unexpected behavior in your application. This could result in service disruptions, errors, or even data loss — an absolute nightmare for any developer! 💥 Immediately upgrade to Expat version 2.4.5 or later to fix this critical issue. Additionally, review your XML input handling practices to ensure robust validation procedures are in place. ⚡ You've got this! By taking these steps, you can fortify your application against potential attacks and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04955 · 92.1th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2022-02-16T06:15Z
Affected products (9)
ProductVersionsFixed in
libexpat_project/libexpat< 2.4.52.4.5
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
oracle/http_serverall versions—
oracle/http_serverall versions—
oracle/zfs_storage_appliance_kitall versions—
siemens/sinema_remote_connect_server< 3.13.1
References (22)
http://www.openwall.com/lists/oss-security/2022/02/19/1 · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · [email protected]https://github.com/libexpat/libexpat/pull/562 · [email protected]https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ · [email protected]https://security.gentoo.org/glsa/202209-24 · [email protected]https://security.netapp.com/advisory/ntap-20220303-0008/ · [email protected]https://www.debian.org/security/2022/dsa-5085 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]http://www.openwall.com/lists/oss-security/2022/02/19/1 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · af854a3a-2127-422b-91ae-364da2661108https://github.com/libexpat/libexpat/pull/562 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-24 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220303-0008/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5085 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-484086.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 16 FEB 00:40Z
    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain…
    cvelistv5