Rejected reason: This CVE ID has been rejected as a duplicate.

Rejected reason: This CVE ID has been rejected as a duplicate.

Important: Release of OpenShift Serverless Logic 1.36.0 security update & enhancements

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Uncontrolled resource consumption vulnerability in the XML catalog processing logic of the libxml2 library. The issue arises when handling chains of XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. During entity resolution, the parser redundantly traverses catalog chains, causing exponential growth in processing time as depth increases. This can be exploited by supplying crafted catalogs to cause excessive CPU consumption and degrade application availability, resulting in a denial-of-service condition.

This update includes the following RPMs:libxml2: libxml2-16-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-devel-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-static-2.15.2-0.3.hum1 (aarch64, x8664) python3-libxml2-2.15.2-0.3.hum1 (aarch64, x8664) libxml2-2.15.2-0.3.hum1.src (src)

This update includes the following RPMs:libxml2: libxml2-16-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-devel-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-static-2.15.3-0.1.hum1 (aarch64, x8664) python3-libxml2-2.15.3-0.1.hum1 (aarch64, x8664) libxml2-2.15.3-0.1.hum1.src (src)