CVE-2022-25235

high-risk

Published 2022-02-16

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Do I need to act?

13.3% chance of exploitation in next 30 days

EPSS score — higher than 87% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (9)

Libexpat

Debian Linux

Fedora

Http Server

Zfs Storage Appliance Kit

Sinema Remote Connect Server

Affected Vendors

Debian Oracle Siemens Fedoraproject Libexpat Project

References (20)

Mailing List http://www.openwall.com/lists/oss-security/2022/02/19/1

Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Patch https://github.com/libexpat/libexpat/pull/562

Mailing List https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.gentoo.org/glsa/202209-24

Third Party Advisory https://security.netapp.com/advisory/ntap-20220303-0008/

Third Party Advisory https://www.debian.org/security/2022/dsa-5085

Patch https://www.oracle.com/security-alerts/cpuapr2022.html