Red Hat Security AdvisoryRHSA-2017:2492
xmlsec1 security update
Released 2017-08-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) xmlsec1-1.2.20-7.el7_4, xmlsec1-openssl-1.2.20-7.el7_4
- Red Hat Enterprise Linux Client Optional (v. 7) xmlsec1-devel-1.2.20-7.el7_4, xmlsec1-gcrypt-1.2.20-7.el7_4, xmlsec1-gcrypt-devel-1.2.20-7.el7_4 +5
- Red Hat Enterprise Linux ComputeNode (v. 7) xmlsec1-1.2.20-7.el7_4, xmlsec1-openssl-1.2.20-7.el7_4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xmlsec1-devel-1.2.20-7.el7_4, xmlsec1-gcrypt-1.2.20-7.el7_4, xmlsec1-gcrypt-devel-1.2.20-7.el7_4 +5
- Red Hat Enterprise Linux Server (v. 7) xmlsec1-1.2.20-7.el7_4, xmlsec1-1.2.20-7.el7_4.ppc, xmlsec1-openssl-1.2.20-7.el7_4 +1
- Red Hat Enterprise Linux Server Optional (v. 7) xmlsec1-devel-1.2.20-7.el7_4, xmlsec1-devel-1.2.20-7.el7_4.ppc, xmlsec1-gcrypt-1.2.20-7.el7_4 +13
- Red Hat Enterprise Linux Workstation (v. 7) xmlsec1-1.2.20-7.el7_4, xmlsec1-openssl-1.2.20-7.el7_4
- Red Hat Enterprise Linux Workstation Optional (v. 7) xmlsec1-devel-1.2.20-7.el7_4, xmlsec1-gcrypt-1.2.20-7.el7_4, xmlsec1-gcrypt-devel-1.2.20-7.el7_4 +5
Fixes 1 record
Priority LOW 34
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service
CVSS 3.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.01352 · Published 2017-07-13 · Partial fix CWE-611
