PT-2024-40236 · Libxml2+1 · Libxml2+1

Published 2024-05-29 · Updated 2024-05-29

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 (affected versions not specified)

Description: The issue concerns a vulnerability to XML Entity Expansion (XEE) attacks, specifically Quadratic Blowup Attacks, in software utilizing libxml2. This vulnerability allows for Denial Of Service attacks against a host's RAM by defining a long entity and referring to it multiple times in document elements, creating a memory sink. The use of certain options like LIBXML NOENT can amplify the impact, and libxml2's defense against related Exponential or Billion Laugh's XEE attacks is only active when the LIBXML PARSEHUGE option is not set.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

GHSA-C636-CG5R-2498

Affected Products

Zend Framework 2

Libxml2

References · 5

• https://osv.dev/vulnerability/GHSA-c636-cg5r-2498 · Vendor Advisory
• https://github.com/symfony/dependency-injection · Note
• https://github.com/symfony/dependency-injection/commit/5c5040c890a8e4085dcd6fa3827f574ab5f71f4c · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/2012-08-28.yaml · Note
• https://symfony.com/blog/security-release-symfony-2-0-17-released · Note