In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Weakness
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libxml2 | Xmlsoft | * | 2.15.4 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | libxml2-0:2.12.5-10.el10_2.4 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | libxml2-0:2.12.5-9.el10_0.9 | * |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | RedHat | libxml2-0:2.9.1-6.el7_9.20 | * |
| Red Hat Enterprise Linux 8 | RedHat | libxml2-0:2.9.7-21.el8_10.9 | * |
| Red Hat Enterprise Linux 8 | RedHat | libxml2-0:2.9.7-21.el8_10.9 | * |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | RedHat | libxml2-0:2.9.7-9.el8_4.20 | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | RedHat | libxml2-0:2.9.7-9.el8_4.20 | * |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | RedHat | libxml2-0:2.9.7-13.el8_6.24 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | RedHat | libxml2-0:2.9.7-13.el8_6.24 | * |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | RedHat | libxml2-0:2.9.7-16.el8_8.24 | * |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | RedHat | libxml2-0:2.9.7-16.el8_8.24 | * |
| Red Hat Enterprise Linux 9 | RedHat | libxml2-0:2.9.13-14.el9_8.5 | * |
| Red Hat Enterprise Linux 9 | RedHat | libxml2-0:2.9.13-14.el9_8.5 | * |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | RedHat | libxml2-0:2.9.13-3.el9_2.20 | * |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | RedHat | libxml2-0:2.9.13-13.el9_4.10 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | libxml2-0:2.9.13-13.el9_6 | * |
| Red Hat OpenShift Container Platform 4.22 | RedHat | openshift/ose-rhel-coreos-9:4.22.9.8.202610241758-0 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1790589912 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-istio-csr-rhel9:1790589914 | * |
| Cert Manager support for Red Hat OpenShift release 1.20 | RedHat | cert-manager/cert-manager-operator-rhel9:1790589855 | * |
| Red Hat Cost Management On-Premise 1 | RedHat | costmanagement/costmanagement-ui-rhel10:1791460851 | * |
| Red Hat Hardened Images | RedHat | libxml2-main-2.15.4-0.1.hum1 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-spyre-rhel9:1793041986 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-rocm-rhel9:1793041981 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-cpu-rhel9:1793042072 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-cuda-rhel9:1793042067 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-tpu-rhel9:1793041987 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-cpu-rhel9:1793329709 | * |
| Red Hat OpenShift AI 3.0 | RedHat | rhai/base-image-cuda-rhel9:1793328358 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-rocm-7.1-rhel9:1793042006 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-cuda-12.9-rhel9:1793042145 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-tpu-rhel9:1793042006 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-gaudi-rhel9:1793042011 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-cuda-13.0-rhel9:1793042086 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-cpu-rhel9:1793042088 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-rocm-6.4-rhel9:1793041995 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-spyre-rhel9:1793042074 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-neuron-rhel9:1793042008 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhai/base-image-cuda-13.0-rhel9:1793326837 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-tpu-rhel9:1793042010 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-cpu-rhel9:1793042162 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-gaudi-rhel9:1793042004 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-rubin-rhel9:1793042092 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-cuda-12.9-rhel9:1793042117 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-cuda-13.0-rhel9:1793042093 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-spyre-rhel9:1793042114 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-rocm-7.14-rhel9:1793042024 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-neuron-rhel9:1793042008 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhai/base-image-cuda-12.9-rhel9:1793327660 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-kubernetes-rhel9:1791978534 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/cds-rhel9:1791978528 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/haproxy-rhel9:1791978528 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/installer-rhel9:1791964013 | * |
| Red Hat Update Infrastructure 5 | RedHat | rhui5/rhua-rhel9:1791978693 | * |
| Libxml2 | Ubuntu | esm-infra-legacy/trusty | * |
| Libxml2 | Ubuntu | esm-infra-legacy/xenial | * |
| Libxml2 | Ubuntu | esm-infra/bionic | * |
| Libxml2 | Ubuntu | esm-infra/focal | * |
| Libxml2 | Ubuntu | jammy | * |
| Libxml2 | Ubuntu | noble | * |
| Libxml2 | Ubuntu | resolute | * |
| Libxml2 | Ubuntu | upstream | * |