CVE-2021-21366: Misinterpretation of malicious XML input
First published: Fri Mar 12 2021(Updated: )
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| xmldom | <0.5.0 | |
| Debian GNU/Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135
- https://github.com/xmldom/xmldom/releases/tag/0.5.0
- https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv
- https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
- https://www.npmjs.com/package/xmldom
Frequently Asked Questions
What is the severity of CVE-2021-21366?
CVE-2021-21366 is considered a moderate severity vulnerability due to its impact on the integrity of XML processing.
How do I fix CVE-2021-21366?
To fix CVE-2021-21366, upgrade to xmldom version 0.5.0 or later to ensure proper handling of system identifiers and namespaces.
What software is affected by CVE-2021-21366?
CVE-2021-21366 affects xmldom versions 0.4.0 and earlier, along with specific installations of Debian GNU/Linux 10.0.
What is the nature of the issue in CVE-2021-21366?
CVE-2021-21366 involves improper preservation of system identifiers, FPIs, and namespaces during XML parsing and serialization.
Can CVE-2021-21366 lead to data leakage?
Yes, CVE-2021-21366 can potentially lead to data leakage or manipulation as it affects the fidelity of XML document processing.
- agent/weakness
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/title
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xmldom project
- canonical/xmldom
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/10.0