FEDORA-2019-18868e1715

security update in Fedora 30 for expat

Status: stable a month ago

This update includes a fix for a security vulnerability, CVE_2018-20843:

Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks

For more information on the changes in 2.2.7, see the upstream release notes at: https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes#L5

Comments 9

This update has been submitted for testing by jorton.

This update test gating status has been changed to 'waiting'.

This update test gating status has been changed to 'ignored'.

This update has been pushed to testing.

karma: +1 critpath: +1
karma: +1 critpath: +1 #1722224: +1

Works

karma: +1

This update has been submitted for stable by bodhi.

This update has been pushed to stable.

Add Comment & Feedback

Please login to add feedback.

Content Type
RPM
Status
stable
Test Gating
Submitted by
Update Type
security
Update Severity
medium
Karma
+3
stable threshold: 3
unstable threshold: -3
Autopush (karma)
Enabled
Autopush (time)
Disabled
Dates
submitted 2 months ago
in testing 2 months ago
in stable a month ago

Related Bugs 2

0+1 #1722224 expat-2.2.7 is available
00 #1723724 CVE-2018-20843 expat: large number of colons in input makes parser consume high amount of resources, leading to DoS [fedora-all]

Automated Test Results