csaf_redhat - rhsa-2024

rhsa-2024_3926

Vulnerability from csaf_redhat

Published

2024-06-13 14:34

Modified

2024-09-16 18:30

Summary

Red Hat Security Advisory: expat security update

Notes

Topic

An update for expat is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Expat is a C library for parsing XML documents. Security Fix(es): * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425) * expat: XML Entity Expansion (CVE-2024-28757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for expat is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)\n\n* expat: XML Entity Expansion (CVE-2024-28757)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:3926",
        "url": "https://access.redhat.com/errata/RHSA-2024:3926"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2262877",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262877"
      },
      {
        "category": "external",
        "summary": "2268766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268766"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3926.json"
      }
    ],
    "title": "Red Hat Security Advisory: expat security update",
    "tracking": {
      "current_release_date": "2024-09-16T18:30:57+00:00",
      "generator": {
        "date": "2024-09-16T18:30:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2024:3926",
      "initial_release_date": "2024-06-13T14:34:32+00:00",
      "revision_history": [
        {
          "date": "2024-06-13T14:34:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-06-13T14:34:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-16T18:30:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.2)",
                  "product_id": "AppStream-9.2.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.2::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
                  "product_id": "BaseOS-9.2.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:9.2::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-devel-0:2.5.0-1.el9_2.1.aarch64",
                "product": {
                  "name": "expat-devel-0:2.5.0-1.el9_2.1.aarch64",
                  "product_id": "expat-devel-0:2.5.0-1.el9_2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.5.0-1.el9_2.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
                "product": {
                  "name": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
                  "product_id": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debugsource@2.5.0-1.el9_2.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
                "product": {
                  "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
                  "product_id": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debuginfo@2.5.0-1.el9_2.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.aarch64",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.aarch64",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
                "product": {
                  "name": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_id": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.5.0-1.el9_2.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
                "product": {
                  "name": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_id": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debugsource@2.5.0-1.el9_2.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
                "product": {
                  "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_id": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debuginfo@2.5.0-1.el9_2.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.ppc64le",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-devel-0:2.5.0-1.el9_2.1.i686",
                "product": {
                  "name": "expat-devel-0:2.5.0-1.el9_2.1.i686",
                  "product_id": "expat-devel-0:2.5.0-1.el9_2.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.5.0-1.el9_2.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debugsource-0:2.5.0-1.el9_2.1.i686",
                "product": {
                  "name": "expat-debugsource-0:2.5.0-1.el9_2.1.i686",
                  "product_id": "expat-debugsource-0:2.5.0-1.el9_2.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debugsource@2.5.0-1.el9_2.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
                "product": {
                  "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
                  "product_id": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debuginfo@2.5.0-1.el9_2.1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.i686",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.i686",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-devel-0:2.5.0-1.el9_2.1.x86_64",
                "product": {
                  "name": "expat-devel-0:2.5.0-1.el9_2.1.x86_64",
                  "product_id": "expat-devel-0:2.5.0-1.el9_2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.5.0-1.el9_2.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
                "product": {
                  "name": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
                  "product_id": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debugsource@2.5.0-1.el9_2.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
                "product": {
                  "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
                  "product_id": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debuginfo@2.5.0-1.el9_2.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.x86_64",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.x86_64",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-devel-0:2.5.0-1.el9_2.1.s390x",
                "product": {
                  "name": "expat-devel-0:2.5.0-1.el9_2.1.s390x",
                  "product_id": "expat-devel-0:2.5.0-1.el9_2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.5.0-1.el9_2.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
                "product": {
                  "name": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
                  "product_id": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debugsource@2.5.0-1.el9_2.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
                "product": {
                  "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
                  "product_id": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-debuginfo@2.5.0-1.el9_2.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.s390x",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.s390x",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.5.0-1.el9_2.1.src",
                "product": {
                  "name": "expat-0:2.5.0-1.el9_2.1.src",
                  "product_id": "expat-0:2.5.0-1.el9_2.1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.5.0-1.el9_2.1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.src",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.src",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.aarch64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.i686",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.s390x",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.5.0-1.el9_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.2)",
          "product_id": "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
        },
        "product_reference": "expat-devel-0:2.5.0-1.el9_2.1.x86_64",
        "relates_to_product_reference": "BaseOS-9.2.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-52425",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2024-02-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2262877"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Expat (libexpat). When parsing a large token that requires multiple buffer fills to complete, Expat has to re-parse the token from start numerous times. This process may trigger excessive resource consumption, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: parsing large tokens can trigger a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The identified flaw in Expat presents a moderate severity issue due to its potential to facilitate resource exhaustion attacks, particularly in scenarios involving parsing large tokens requiring multiple buffer fills. As Expat repeatedly re-parses such tokens from the beginning, it results in disproportionate resource consumption, leading to a denial-of-service (DoS) condition. While the impact is significant, the exploitation requires specific conditions, such as parsing large tokens, which may not always align with typical usage patterns.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-52425"
        },
        {
          "category": "external",
          "summary": "RHBZ#2262877",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262877"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-52425",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-52425"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52425",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52425"
        }
      ],
      "release_date": "2024-02-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, applications using the Expat library must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:3926"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "expat: parsing large tokens can trigger a denial of service"
    },
    {
      "cve": "CVE-2024-28757",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2024-03-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An XML Entity Expansion flaw was found in libexpat. This flaw allows an attacker to cause a denial of service when there is an isolated use of external parsers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: XML Entity Expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Direct recursion of parameter entities repeatedly referenced themselves, creating a loop that was not detected in the external subset. This is against XML rules and caused unpredictable behaviour during runtime, which could lead to a denial of service (DoS) attack",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
          "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
          "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
          "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
          "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-28757"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-28757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-28757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-28757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28757"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/issues/839",
          "url": "https://github.com/libexpat/libexpat/issues/839"
        }
      ],
      "release_date": "2024-03-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, applications using the Expat library must be restarted for the update to take effect.",
          "product_ids": [
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:3926"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "AppStream-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "AppStream-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.src",
            "BaseOS-9.2.0.Z.EUS:expat-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debuginfo-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-debugsource-0:2.5.0-1.el9_2.1.x86_64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.aarch64",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.i686",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.ppc64le",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.s390x",
            "BaseOS-9.2.0.Z.EUS:expat-devel-0:2.5.0-1.el9_2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "expat: XML Entity Expansion"
    }
  ]
}

cve-2023-52425

Vulnerability from cvelistv5

Published

2024-02-04 00:00

Modified

2024-08-26 19:22

Severity

7.5 (High) - cvssV3_1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

References

URL	Tags
https://github.com/libexpat/libexpat/pull/789
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/	vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html	mailing-list
http://www.openwall.com/lists/oss-security/2024/03/20/5	mailing-list
https://security.netapp.com/advisory/ntap-20240614-0003/

Impacted products

Vendor	Product
n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.543Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/pull/789"
          },
          {
            "name": "FEDORA-2024-fbe1f0c1aa",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"
          },
          {
            "name": "FEDORA-2024-b8656bc059",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/"
          },
          {
            "name": "[debian-lts-announce] 20240409 [SECURITY] [DLA 3783-1] expat security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html"
          },
          {
            "name": "[oss-security] 20240320 Security fixes in Python 3.10.14, 3.9.19, and 3.8.19 (CVE-2023-6597 \u0026 CVE-2024-0450)",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240614-0003/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "libexpat",
            "vendor": "libexpat_project",
            "versions": [
              {
                "lessThanOrEqual": "2.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52425",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T19:20:56.852251Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T19:22:48.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-14T13:06:11.482117",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/789"
        },
        {
          "name": "FEDORA-2024-fbe1f0c1aa",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"
        },
        {
          "name": "FEDORA-2024-b8656bc059",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/"
        },
        {
          "name": "[debian-lts-announce] 20240409 [SECURITY] [DLA 3783-1] expat security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html"
        },
        {
          "name": "[oss-security] 20240320 Security fixes in Python 3.10.14, 3.9.19, and 3.8.19 (CVE-2023-6597 \u0026 CVE-2024-0450)",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240614-0003/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-52425",
    "datePublished": "2024-02-04T00:00:00",
    "dateReserved": "2024-02-04T00:00:00",
    "dateUpdated": "2024-08-26T19:22:48.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-28757

Vulnerability from cvelistv5

Published

2024-03-10 00:00

Modified

2024-08-02 00:56

Severity

Summary

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

References

URL	Tags
https://github.com/libexpat/libexpat/pull/842
https://github.com/libexpat/libexpat/issues/839
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/	vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/	vendor-advisory
https://security.netapp.com/advisory/ntap-20240322-0001/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/	vendor-advisory
http://www.openwall.com/lists/oss-security/2024/03/15/1	mailing-list

Impacted products

Vendor	Product
n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T13:15:18.395170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:07.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:56:58.387Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/pull/842"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/libexpat/libexpat/issues/839"
          },
          {
            "name": "FEDORA-2024-4e6e660fae",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/"
          },
          {
            "name": "FEDORA-2024-40b98c9ced",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240322-0001/"
          },
          {
            "name": "FEDORA-2024-afb73e6f62",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/"
          },
          {
            "name": "[oss-security] 20240315 Expat 2.6.2 released, includes security fixes",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/15/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T19:07:21.211670",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/842"
        },
        {
          "url": "https://github.com/libexpat/libexpat/issues/839"
        },
        {
          "name": "FEDORA-2024-4e6e660fae",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/"
        },
        {
          "name": "FEDORA-2024-40b98c9ced",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240322-0001/"
        },
        {
          "name": "FEDORA-2024-afb73e6f62",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/"
        },
        {
          "name": "[oss-security] 20240315 Expat 2.6.2 released, includes security fixes",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/03/15/1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-28757",
    "datePublished": "2024-03-10T00:00:00",
    "dateReserved": "2024-03-10T00:00:00",
    "dateUpdated": "2024-08-02T00:56:58.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

rhsa-2024_3926

Vulnerability from csaf_redhat

cve-2023-52425

Vulnerability from cvelistv5

cve-2024-28757

Vulnerability from cvelistv5

Tags