NULL Pointer Dereference in lxml/lxml
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.
Summary
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lxml | lxml/lxml | before 4.9.1 | 4.9.1 | Patch available | CNA |
| — | lxml (PyPI) | before 4.9.1 | 4.9.1 | Patch available | GHSA-wrxv-2j5q-m38w |
- lxml/lxml Vendorlxml Affected before 4.9.1 Fixed in 4.9.1 Patch available CNA
- lxml (PyPI) Vendor— Affected before 4.9.1 Fixed in 4.9.1 Patch available GHSA-wrxv-2j5q-m38w
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* | before 4.9.1 | Vulnerable | lxml |
| cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* | 2.9.10 – 2.9.14 | Running on | xmlsoft |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* Versions before 4.9.1 Vulnerable ·lxml
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions 2.9.10 – 2.9.14 Running on ·xmlsoft
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA lxml/lxml (lxml) Fixed in 4.9.1
- Fix · GHSA-wrxv-2j5q-m38w lxml (PyPI) Fixed in 4.9.1 Advisory →
Red Hat 1 advisory
- RHSA-2022:8226 Released 2022-11-15 · Red Hat rating Moderatepython-lxml security update
- Red Hat Enterprise Linux AppStream (v. 9) python-lxml-4.6.5-3.el9, python3-lxml-4.6.5-3.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8226 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2309
- 2026-10-03 Alias added: GHSA-wrxv-2j5q-m38w
References
Advisory 6
Other 9
- https://github.com/lxml/lxml
- https://github.com/lxml/lxml/blob/master/CHANGES.txt
- https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml
- https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO
- https://security.netapp.com/advisory/ntap-20220915-0006
More Lxml vulnerabilities
- TI-2021-19624 HTML Cleaner allows crafted and SVG embedded scripts to pass through CVSS 3.1HIGH 8.2
- TI-2026-29705 lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files CVSS 3.1HIGH 7.5
- TI-2014-02511 Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5… CVSS 3.1MEDIUM 6.1
- TI-2021-09882 An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. CVSS 3.1MEDIUM 6.1
- TI-2020-16868 Cross-site scripting in python-lxml CVSS 3.1MEDIUM 6.1
- TI-2018-14010 An issue was discovered in lxml before 4.2.5. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-2309 · CVE Program
- CVE-2022-2309 · NVD
- FIRST EPSS
- GHSA-wrxv-2j5q-m38w · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2309 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences