CVE-2022-25236CWE-668

CVE-2022-25236

Critical · published February 16, 2022

CVSS v3.1
9.8
EPSS
35%
Percentile
98.4
In the wild
Unconfirmed
What it is

🚨 Namespace-separator characters just snuck their way into Expat’s namespace URIs! This critical vulnerability could lead to some seriously unwanted consequences! 🔥 Think of it like a restaurant where the chef takes orders but misreads the menu, confusing ingredients that shouldn’t mix. This oversight can create chaotic dishes that no one wants to eat! An attacker could exploit this vulnerability to manipulate how XML namespaces are processed, potentially leading to security breaches and corrupted data. Imagine the havoc of a misadjusted recipe — it could compromise the entire application and leave users vulnerable. It's a recipe for disaster!

Put simply

Think of it like a restaurant where the chef takes orders but misreads the menu, confusing ingredients that shouldn’t mix. This oversight can create chaotic dishes that no one wants to eat! This vulnerability in xmlparse.c of Expat (libexpat) allows attackers to insert namespace-separator characters into namespace URIs, which can disrupt the expected processing of XML data, leading to unintended behavior.

What to do

An attacker could exploit this vulnerability to manipulate how XML namespaces are processed, potentially leading to security breaches and corrupted data. Imagine the havoc of a misadjusted recipe — it could compromise the entire application and leave users vulnerable. It's a recipe for disaster! Upgrade Expat to version 2.4.5 or later immediately to patch this vulnerability. Additionally, review your XML processing functions to ensure they handle namespaces properly. Don't wait, secure your applications now! You’ve got this! With these updates, you’ll be bolstering your defenses against potential attacks in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.35271 · 98.4th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2022-02-16T06:15Z
Affected products (7)
ProductVersionsFixed in
libexpat_project/libexpat< 2.4.52.4.5
debian/debian_linuxall versions—
debian/debian_linuxall versions—
oracle/http_serverall versions—
oracle/http_serverall versions—
oracle/zfs_storage_appliance_kitall versions—
siemens/sinema_remote_connect_server< 3.13.1
References (24)
http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html · [email protected]http://www.openwall.com/lists/oss-security/2022/02/19/1 · [email protected]https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · [email protected]https://github.com/libexpat/libexpat/pull/561 · [email protected]https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ · [email protected]https://security.gentoo.org/glsa/202209-24 · [email protected]https://security.netapp.com/advisory/ntap-20220303-0008/ · [email protected]https://www.debian.org/security/2022/dsa-5085 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/02/19/1 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · af854a3a-2127-422b-91ae-364da2661108https://github.com/libexpat/libexpat/pull/561 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-24 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220303-0008/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5085 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-484086.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 16 FEB 00:39Z
    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs
    cvelistv5