CVE-2024-40896: Analysis: libxml2 XXE due to type confusion
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.10+dfsg-6.7+deb11u4Fixed in 2.9.10+dfsg-6.7+deb11u5Fixed in 2.9.14+dfsg-1.3~deb12u1Fixed in 2.12.7+dfsg+really2.9.14-0.2 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.11.9 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.12.9 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.13.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40896?
CVE-2024-40896 is classified as a high severity vulnerability affecting libxml2.
How do I fix CVE-2024-40896?
To fix CVE-2024-40896, upgrade libxml2 to versions 2.11.9, 2.12.9, or 2.13.3 or later.
Which versions of libxml2 are affected by CVE-2024-40896?
CVE-2024-40896 affects libxml2 versions prior to 2.11.9, 2.12.9, and 2.13.3.
What type of attack does CVE-2024-40896 allow?
CVE-2024-40896 makes classic XML External Entity (XXE) attacks possible.
What is the nature of the vulnerability in CVE-2024-40896?
CVE-2024-40896 involves the SAX parser producing events for external entities despite attempts to override entity content.