PT-2021-6454 · Xmldom+1 · Xmldom+1

Karfau · Published 2021-07-10 · Updated 2022-04-25 · CVE-2021-32796

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions xmldom versions 0.6.0 and older

Description The issue is related to the incorrect filtering of special characters in the XML DOM implementation. This may lead to unexpected syntactic changes during XML processing in some downstream applications. The problem has been resolved in version 0.7.0. As a workaround, downstream applications can validate the input and reject maliciously crafted documents.

Recommendations For versions 0.6.0 and older, update to version 0.7.0 or newer to resolve the issue. As a temporary workaround, consider validating the input and rejecting maliciously crafted documents in downstream applications.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-91

Related Identifiers

BDU:2022-01661

CVE-2021-32796

GHSA-5FG8-2547-MR8Q

Affected Products

Debian

Xmldom

References · 18

• https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32796 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-32796 · Security Note
• https://bdu.fstec.ru/vul/2022-01661 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32796 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5fg8-2547-mr8q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32796 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32796 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32796 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32796 · Vendor Advisory
• https://github.com/xmldom/xmldom · Note
• https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q · Note
• https://t.me/cibsecurity/26549 · Telegram Post
• https://t.me/cvenotify/18211 · Telegram Post
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities · Note