CVE-2024-28757
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-28757
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28757.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-28757
- Related
- Published
- 2024-03-10T05:15:06Z
- Modified
- 2024-10-08T04:11:27.960113Z
- Summary
- [none]
- Details
-
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
- References
-
- https://security.netapp.com/advisory/ntap-20240322-0001/
- https://github.com/libexpat/libexpat/issues/839
- http://www.openwall.com/lists/oss-security/2024/03/15/1
- https://github.com/libexpat/libexpat/pull/842
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/
- https://security.alpinelinux.org/vuln/CVE-2024-28757
- https://security-tracker.debian.org/tracker/CVE-2024-28757
Affected packages
Alpine:v3.16 / expat
Package
- Name
- expat
- Purl
- pkg:apk/alpine/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.2-r0
Affected versions
2.*
2.0.1-r0
2.0.1-r1
2.0.1-r2
2.0.1-r3
2.0.1-r4
2.0.1-r5
2.0.1-r6
2.1.0-r0
2.1.0-r1
2.1.0-r2
2.1.1-r0
2.2.0-r0
2.2.0-r1
2.2.1-r0
2.2.2-r0
2.2.3-r0
2.2.3-r1
2.2.4-r0
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.7-r1
2.2.8-r0
2.2.9-r0
2.2.9-r1
2.2.10-r0
2.2.10-r1
2.3.0-r0
2.4.1-r0
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.5-r0
2.4.6-r0
2.4.7-r0
2.4.8-r0
2.4.9-r0
2.5.0-r0
2.6.0-r0
Alpine:v3.17 / expat
Package
- Name
- expat
- Purl
- pkg:apk/alpine/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.2-r0
Affected versions
2.*
2.0.1-r0
2.0.1-r1
2.0.1-r2
2.0.1-r3
2.0.1-r4
2.0.1-r5
2.0.1-r6
2.1.0-r0
2.1.0-r1
2.1.0-r2
2.1.1-r0
2.2.0-r0
2.2.0-r1
2.2.1-r0
2.2.2-r0
2.2.3-r0
2.2.3-r1
2.2.4-r0
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.7-r1
2.2.8-r0
2.2.9-r0
2.2.9-r1
2.2.10-r0
2.2.10-r1
2.3.0-r0
2.4.1-r0
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.5-r0
2.4.6-r0
2.4.7-r0
2.4.8-r0
2.4.8-r1
2.4.9-r0
2.5.0-r0
2.6.0-r0
Alpine:v3.18 / expat
Package
- Name
- expat
- Purl
- pkg:apk/alpine/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.2-r0
Affected versions
2.*
2.0.1-r0
2.0.1-r1
2.0.1-r2
2.0.1-r3
2.0.1-r4
2.0.1-r5
2.0.1-r6
2.1.0-r0
2.1.0-r1
2.1.0-r2
2.1.1-r0
2.2.0-r0
2.2.0-r1
2.2.1-r0
2.2.2-r0
2.2.3-r0
2.2.3-r1
2.2.4-r0
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.7-r1
2.2.8-r0
2.2.9-r0
2.2.9-r1
2.2.10-r0
2.2.10-r1
2.3.0-r0
2.4.1-r0
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.5-r0
2.4.6-r0
2.4.7-r0
2.4.8-r0
2.4.8-r1
2.4.9-r0
2.5.0-r0
2.5.0-r1
2.6.0-r0
Alpine:v3.19 / expat
Package
- Name
- expat
- Purl
- pkg:apk/alpine/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.2-r0
Affected versions
2.*
2.0.1-r0
2.0.1-r1
2.0.1-r2
2.0.1-r3
2.0.1-r4
2.0.1-r5
2.0.1-r6
2.1.0-r0
2.1.0-r1
2.1.0-r2
2.1.1-r0
2.2.0-r0
2.2.0-r1
2.2.1-r0
2.2.2-r0
2.2.3-r0
2.2.3-r1
2.2.4-r0
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.7-r1
2.2.8-r0
2.2.9-r0
2.2.9-r1
2.2.10-r0
2.2.10-r1
2.3.0-r0
2.4.1-r0
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.5-r0
2.4.6-r0
2.4.7-r0
2.4.8-r0
2.4.8-r1
2.4.9-r0
2.5.0-r0
2.5.0-r1
2.5.0-r2
2.6.0-r0
Alpine:v3.20 / expat
Package
- Name
- expat
- Purl
- pkg:apk/alpine/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.2-r0
Affected versions
2.*
2.0.1-r0
2.0.1-r1
2.0.1-r2
2.0.1-r3
2.0.1-r4
2.0.1-r5
2.0.1-r6
2.1.0-r0
2.1.0-r1
2.1.0-r2
2.1.1-r0
2.2.0-r0
2.2.0-r1
2.2.1-r0
2.2.2-r0
2.2.3-r0
2.2.3-r1
2.2.4-r0
2.2.5-r0
2.2.6-r0
2.2.7-r0
2.2.7-r1
2.2.8-r0
2.2.9-r0
2.2.9-r1
2.2.10-r0
2.2.10-r1
2.3.0-r0
2.4.1-r0
2.4.2-r0
2.4.3-r0
2.4.4-r0
2.4.5-r0
2.4.6-r0
2.4.7-r0
2.4.8-r0
2.4.8-r1
2.4.9-r0
2.5.0-r0
2.5.0-r1
2.5.0-r2
2.6.0-r0
2.6.1-r0
Debian:11 / expat
Package
- Name
- expat
- Purl
- pkg:deb/debian/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2.*
2.2.10-2
2.2.10-2+deb11u1
2.2.10-2+deb11u2
2.2.10-2+deb11u3
2.2.10-2+deb11u4
2.2.10-2+deb11u5
2.2.10-2+deb11u6
2.3.0-1
2.4.1-1
2.4.1-2
2.4.1-3
2.4.2-1
2.4.3-1
2.4.3-2
2.4.3-3
2.4.4-1
2.4.5-1
2.4.5-2
2.4.6-1
2.4.7-1
2.4.8-1
2.4.8-2
2.4.9-1
2.5.0-1
2.5.0-2
2.6.0-1
2.6.1-1
2.6.1-2
2.6.2-1
2.6.2-2
2.6.3-1
Debian:12 / expat
Package
- Name
- expat
- Purl
- pkg:deb/debian/expat?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:13 / expat
Package
- Name
- expat
- Purl
- pkg:deb/debian/expat?arch=source
Git / github.com/libexpat/libexpat
Affected ranges
- Type
- GIT
- Repo
- https://github.com/libexpat/libexpat
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
Affected versions
Other
REC1_0
R_1_95_0
R_1_95_2
R_1_95_3
R_1_95_4
R_1_95_5
R_1_95_6
R_1_95_7
R_1_95_8
R_2_0_0
R_2_0_1
R_2_1_0
R_2_1_1
R_2_2_0
R_2_2_1
R_2_2_10
R_2_2_2
R_2_2_3
R_2_2_4
R_2_2_5
R_2_2_6
R_2_2_7
R_2_2_8
R_2_2_9
R_2_3_0
R_2_4_0
R_2_4_1
R_2_4_2
R_2_4_3
R_2_4_4
R_2_4_5
R_2_4_6
R_2_4_7
R_2_4_8
R_2_4_9
R_2_5_0
R_2_6_0
R_2_6_1
V1990307
V19981122
V19981231
V19990109
V19990425
V19990626
V19990709
V19990728
V19991013
V1_0
V1_1
V20000512
beta2
beta3
beta4
jclark-orig
libexpat-alpha-1
sourceforge_init
start