Bug 1211996 (CVE-2023-34411)

Summary:	VUL-0: TRACKERBUG: CVE-2023-34411: xml-rs: denial of service via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Thomas Leroy <thomas.leroy>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	camila.matos, carlos.lopez, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/368371/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-34411:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:	1211997, 1211998, 1212000, 1212002, 1212003, 1212004, 1212005, 1212007, 1212008, 1212009, 1212010, 1212011, 1212012, 1212013
Bug Blocks:

Description Thomas Leroy 2023-06-05 08:40:05 UTC

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service
(panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML
document.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-34411
https://www.cve.org/CVERecord?id=CVE-2023-34411
https://github.com/00xc/xml-rs/commit/0f084d45aa53e4a27476961785f59f2bd7d59a9f
https://github.com/netvl/xml-rs/commit/c09549a187e62d39d40467f129e64abf32efc35c
https://github.com/netvl/xml-rs/compare/0.8.13...0.8.14
https://github.com/netvl/xml-rs/pull/226

Comment 1 Thomas Leroy 2023-06-05 08:41:37 UTC

A vulnerable version of xml-rs crate is embedded is the following packages:

SUSE:SLE-15-SP2:Update/librsvg,2,xml-rs,0.8.3
SUSE:SLE-15-SP3:Update:Products:MicroOS52:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP4:Update/gstreamer-plugins-rs,1,xml-rs,0.8.4
SUSE:SLE-15-SP4:Update:Products:Micro53:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP4:Update:Products:Micro54:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP5:Update/gstreamer-plugins-rs,3,xml-rs,0.8.4
openSUSE:Factory/afterburn,10,xml-rs,0.8.4
openSUSE:Factory/alacritty,31,xml-rs,0.8.13
openSUSE:Factory/cargo-audit,15,xml-rs,0.8.4
openSUSE:Factory/git-delta,10,xml-rs,0.8.3
openSUSE:Factory/gnome-podcasts,2,xml-rs,0.8.4
openSUSE:Factory/gstreamer-plugins-rs,19,xml-rs,0.8.4
openSUSE:Factory/lapce,13,xml-rs,0.8.4
openSUSE:Factory/ncspot,12,xml-rs,0.8.4
openSUSE:Factory/stl-thumb,2,xml-rs,0.8.4
openSUSE:Factory/swww,6,xml-rs,0.8.7
openSUSE:Factory/wayshot,6,xml-rs,0.8.4
openSUSE:Factory/wezterm,24,xml-rs,0.8.4
openSUSE:Factory/wl-clipboard-rs,1,xml-rs,0.8.4
openSUSE:Factory/wlgreet,7,xml-rs,0.8.4

Comment 2 Carlos López 2023-06-13 08:50:10 UTC

(In reply to Thomas Leroy from comment #1)
> A vulnerable version of xml-rs crate is embedded is the following packages:
> ...

Actually this was introduced in 0.8.9:
https://github.com/netvl/xml-rs/pull/226#issuecomment-1588836538