libexpat up to 2.6.3 XML_ResumeParser denial of service

Summaryinfo

A vulnerability was found in libexpat up to 2.6.3. It has been declared as problematic. The affected element is the function XML_ResumeParser. Executing a manipulation can lead to denial of service. This vulnerability is registered as CVE-2024-50602. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in libexpat up to 2.6.3. This vulnerability affects the function XML_ResumeParser. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-50602 since 10/27/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 210723 (CBL Mariner 2.0 Security Update: expat (CVE-2024-50602)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.6.4 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (210723) and CERT Bund (WID-SEC-2024-3281). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM AIX
• IBM VIOS
• Debian Linux
• IBM DB2
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• HCL Commerce
• IBM Power Hardware Management Console
• SUSE openSUSE
• Broadcom Brocade SANnav
• Dell PowerScale OneFS
• IBM MQ
• IBM App Connect Enterprise
• OpenBSD OpenBSD
• Open Source expat
• Dell Avamar
• Red Hat OpenShift
• IBM QRadar SIEM
• Dell integrated Dell Remote Access Controller
• NetApp ActiveIQ Unified Manager
• Tenable Security Nessus Network Monitor
• Dell PowerProtect Data Domain
• IBM Security Verify Access

Productinfo

Name

• libexpat

Version

• 2.6.0
• 2.6.1
• 2.6.2
• 2.6.3

Website

• Product: https://github.com/libexpat/libexpat/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion