CVE-2022-2309: Null Pointer Dereference
First published: Tue Jul 05 2022(Updated: )
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lxml Lxml | <4.9.1 | |
| Xmlsoft Libxml2 | >=2.9.10<=2.9.14 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f
- https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/
- https://security.gentoo.org/glsa/202208-06
- https://security.netapp.com/advisory/ntap-20220915-0006/
Frequently Asked Questions
What is CVE-2022-2309?
CVE-2022-2309 is a vulnerability that allows attackers to cause a denial of service or application crash in lxml when used with libxml2 2.9.10 through 2.9.14.
What is the severity of CVE-2022-2309?
The severity of CVE-2022-2309 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2022-2309?
CVE-2022-2309 affects lxml when used with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier versions are not affected.
How can an attacker exploit CVE-2022-2309?
An attacker can exploit CVE-2022-2309 by triggering crashes through forged input data when vulnerable code is executed.
How can I fix CVE-2022-2309?
To fix CVE-2022-2309, update lxml to version 4.9.1 using pip.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-wrxv-2j5q-m38w
- alias/CVE-2022-2309
- collector/github-advisory-latest
- collector/nvd-cve
- collector/nvd-index
- package-manager/pip
- vendor/lxml
- canonical/lxml lxml
- vendor/xmlsoft
- canonical/xmlsoft libxml2
- version/xmlsoft libxml2/2.9.10
- version/xmlsoft libxml2/2.9.14
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37