In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Weakness
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libxml2 | Xmlsoft | * | 2.15.4 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | libxml2-0:2.12.5-10.el10_2.4 | * |
| Red Hat Enterprise Linux 8 | RedHat | libxml2-0:2.9.7-21.el8_10.9 | * |
| Red Hat Enterprise Linux 8 | RedHat | libxml2-0:2.9.7-21.el8_10.9 | * |
| Red Hat Enterprise Linux 9 | RedHat | libxml2-0:2.9.13-14.el9_8.5 | * |
| Red Hat Enterprise Linux 9 | RedHat | libxml2-0:2.9.13-14.el9_8.5 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1790589912 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-istio-csr-rhel9:1790589914 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-operator-rhel9:1790589855 | * |
| Red Hat Cost Management On-Premise 1 | RedHat | costmanagement/costmanagement-ui-rhel10:1791460851 | * |
| Red Hat Hardened Images | RedHat | libxml2-main-2.15.4-0.1.hum1 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-kubernetes-rhel9:1791978534 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1791978528 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1791978528 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1791964013 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1791978693 | * |
| Libxml2 | Ubuntu | esm-infra-legacy/trusty | * |
| Libxml2 | Ubuntu | esm-infra-legacy/xenial | * |
| Libxml2 | Ubuntu | esm-infra/bionic | * |
| Libxml2 | Ubuntu | esm-infra/focal | * |
| Libxml2 | Ubuntu | jammy | * |
| Libxml2 | Ubuntu | noble | * |
| Libxml2 | Ubuntu | resolute | * |
| Libxml2 | Ubuntu | upstream | * |