PT-2021-22894 · Apache · Apache Openoffice+1

Dave Fisher · Published 2021-09-23 · Updated 2021-10-15 · CVE-2021-40439

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.11

Description The issue is related to a dependency on expat software, which is vulnerable to a "Billion Laughs" entity expansion denial of service attack. This can be exploited via crafted XML files. Since ODF files consist of a set of XML files, this poses a risk.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 or later, as expat in version 4.1.11 is patched.

Fix

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-40439

Affected Products

Apache Openoffice

Openoffice

References · 7

• https://osv.dev/vulnerability/CVE-2021-40439 · Vendor Advisory
• https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40439 · Security Note
• http://openwall.com/lists/oss-security/2021/10/07/4 · Note
• https://t.me/cibsecurity/30189 · Telegram Post
• https://t.me/cvenotify/22071 · Telegram Post
• https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E · Note