xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop

4.3 CVSS

Vulnerability Description

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-4249

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from unspecified

View All →

CVE-2022-4642

tatoeba2 Profile Name cross site scripting

Low 3.5

CVE-2022-4641

pig-vector LogisticRegression.java LogisticRegression temp file

Low 2.5

CVE-2022-4639

sslh Packet Dumping probe.c hexdump format string

Medium 5.6

CVE-2022-4638

collective.contact.widget widgets.py title cross site scripting

Low 3.5

CVE-2022-4631

WP-Ban ban-options.php cross site scripting

Low 3.5

Affected Vendor

unspecified

View all reports →

Affected Software

xml-conduit

Vulnerable Versions:

0.5.0, 0.5.0.1, 0.5.1, 0.5.1.1, 0.5.1.2, 0.5.2, 0.5.3, 0.5.3.1, 0.5.4, 0.6.0, 0.6.1, 0.7.0, 0.7.0.1, 0.7.0.2, 0.7.0.3, 1.0.0, 1.0.1, 1.0.1.1, 1.0.2, 1.0.2.1, 1.0.3, 1.0.3.1, 1.0.3.2, 1.0.3.3, 1.1.0, 1.1.0.1, 1.1.0.2, 1.1.0.3, 1.1.0.4, 1.1.0.5, 1.1.0.6, 1.1.0.7, 1.1.0.8, 1.1.0.9, 1.2.0, 1.2.0.1, 1.2.0.2, 1.2.0.3, 1.2.1, 1.2.1.1, 1.2.2, 1.2.3, 1.2.3.1, 1.2.3.2, 1.2.3.3, 1.2.4, 1.2.5, 1.2.5.1, 1.2.6, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.3.1, 1.3.4, 1.3.4.1, 1.3.4.2, 1.3.5, 1.4.0, 1.4.0.1, 1.4.0.2, 1.4.0.3, 1.4.0.4, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.7.0.1, 1.7.1.0, 1.7.1.1, 1.7.1.2, 1.8.0, 1.8.0.1, 1.9.0.0