PT-2017-4096 · Aleksey Sanin+4 · Xmlsec+4

Published 2017-05-29 · Updated 2022-10-13 · CVE-2017-1000061

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions xmlsec versions 1.2.23 and earlier

Description The issue is related to the incorrect restriction of XML links to external objects in the xmlsec crypt library. This can allow a remote attacker to impact the confidentiality and availability of protected information. The vulnerability may be exploited when parsing crafted input documents, potentially resulting in information disclosure or denial of service.

Recommendations For xmlsec versions 1.2.23 and earlier, update to a version later than 1.2.23 to resolve the issue. At the moment, there is no information about other versions that may contain a fix for this issue.

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2017-1664

BDU:2021-02624

CESA-2017_2492

CVE-2017-1000061

MGASA-2017-0305

MGASA-2020-0104

RHSA-2017:2492

RHSA-2017_2492

USN-5674-1

Affected Products

Alt Linux

Centos

Red Hat

Ubuntu

Xmlsec

References · 24

• https://github.com/lsh123/xmlsec/issues/43 · Patch
• https://bdu.fstec.ru/vul/2021-02624 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-1000061 · Security Note
• https://ubuntu.com/security/notices/USN-5674-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0104.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000061 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000061 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0305.html · Security Note
• https://access.redhat.com/errata/RHSA-2017:2492 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5674-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0104 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2017-2492.html · Vendor Advisory