CVE Vulnerabilities

CVE-2024-45490

Improper Restriction of XML External Entity Reference

Published: Aug 30, 2024 | Modified: Nov 04, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Weakness

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected Software

Name Vendor Start Version End Version
Libexpat Libexpat_project * 2.6.3 (excluding)
Red Hat Enterprise Linux 8 RedHat expat-0:2.2.5-15.el8_10 *
Red Hat Enterprise Linux 9 RedHat expat-0:2.5.0-2.el9_4.1 *
Red Hat Enterprise Linux 9 RedHat expat-0:2.5.0-2.el9_4.1 *
Red Hat JBoss Core Services 2.4.62 RedHat expat *
Red Hat OpenShift Container Platform 4.16 RedHat rhcos-416.94.202410020522-0 *
Red Hat OpenShift Container Platform 4.17 RedHat rhcos-417.94.202411070820-0 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-config-sync-rhel9:1.4.7-3 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-flow-collector-rhel9:1.4.7-3 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-operator-bundle:1.4.7-4 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-router-rhel9:2.4.3-7 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-service-controller-rhel9:1.4.7-3 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-site-controller-rhel9:1.4.7-3 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-config-sync-rhel9:1.4.7-2 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-flow-collector-rhel9:1.4.7-2 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-operator-bundle:1.4.7-2 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-router-rhel9:2.4.3-6 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-service-controller-rhel9:1.4.7-2 *
Service Interconnect 1.4 for RHEL 9 RedHat service-interconnect/skupper-site-controller-rhel9:1.4.7-2 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-config-sync-rhel9:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-controller-podman-container-rhel9:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-controller-podman-rhel9:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-flow-collector-rhel9:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-operator-bundle:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-router-rhel9:2.5.3-6 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-service-controller-rhel9:1.5.5-4 *
Service Interconnect 1 for RHEL 9 RedHat service-interconnect/skupper-site-controller-rhel9:1.5.5-4 *
Cadaver Ubuntu focal *
Cadaver Ubuntu oracular *
Coin3 Ubuntu trusty/esm *
Expat Ubuntu esm-infra-legacy/trusty *
Expat Ubuntu esm-infra/bionic *
Expat Ubuntu esm-infra/focal *
Expat Ubuntu esm-infra/xenial *
Expat Ubuntu focal *
Expat Ubuntu jammy *
Expat Ubuntu noble *
Expat Ubuntu trusty/esm *
Insighttoolkit4 Ubuntu focal *
Libxmltok Ubuntu esm-apps/bionic *
Libxmltok Ubuntu esm-apps/focal *
Libxmltok Ubuntu esm-apps/jammy *
Libxmltok Ubuntu esm-apps/noble *
Libxmltok Ubuntu esm-apps/xenial *
Libxmltok Ubuntu focal *
Libxmltok Ubuntu jammy *
Libxmltok Ubuntu noble *
Libxmltok Ubuntu oracular *
Libxmltok Ubuntu plucky *
Matanza Ubuntu devel *
Matanza Ubuntu esm-apps/bionic *
Matanza Ubuntu esm-apps/focal *
Matanza Ubuntu esm-apps/jammy *
Matanza Ubuntu esm-apps/noble *
Matanza Ubuntu esm-apps/xenial *
Matanza Ubuntu focal *
Matanza Ubuntu jammy *
Matanza Ubuntu noble *
Matanza Ubuntu oracular *
Matanza Ubuntu plucky *
Matanza Ubuntu questing *
Swish-e Ubuntu focal *
Swish-e Ubuntu oracular *
Tdom Ubuntu focal *
Tdom Ubuntu oracular *
Vnc4 Ubuntu trusty/esm *
Vtk Ubuntu trusty/esm *
Wbxml2 Ubuntu focal *
Wbxml2 Ubuntu oracular *
Xmlrpc-c Ubuntu focal *
Xmlrpc-c Ubuntu oracular *
Xmlrpc-c Ubuntu trusty/esm *

Potential Mitigations

References