Bug 1211996 (CVE-2023-34411) - VUL-0: TRACKERBUG: CVE-2023-34411: xml-rs: denial of service via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.
Summary: VUL-0: TRACKERBUG: CVE-2023-34411: xml-rs: denial of service via an invalid <...
Status: RESOLVED FIXED
Alias: CVE-2023-34411
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/368371/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-34411:7.5:(AV:...
Keywords:
Depends on: 1211997 1211998 1212000 1212002 1212003 1212004 1212005 1212007 1212008 1212009 1212010 1212011 1212012 1212013
Blocks:
  Show dependency tree / graph
 
Reported: 2023-06-05 08:40 UTC by Thomas Leroy
Modified: 2024-07-02 14:12 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Thomas Leroy 2023-06-05 08:41:37 UTC 
A vulnerable version of xml-rs crate is embedded is the following packages:

SUSE:SLE-15-SP2:Update/librsvg,2,xml-rs,0.8.3
SUSE:SLE-15-SP3:Update:Products:MicroOS52:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP4:Update/gstreamer-plugins-rs,1,xml-rs,0.8.4
SUSE:SLE-15-SP4:Update:Products:Micro53:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP4:Update:Products:Micro54:Update/afterburn,1,xml-rs,0.8.3
SUSE:SLE-15-SP5:Update/gstreamer-plugins-rs,3,xml-rs,0.8.4
openSUSE:Factory/afterburn,10,xml-rs,0.8.4
openSUSE:Factory/alacritty,31,xml-rs,0.8.13
openSUSE:Factory/cargo-audit,15,xml-rs,0.8.4
openSUSE:Factory/git-delta,10,xml-rs,0.8.3
openSUSE:Factory/gnome-podcasts,2,xml-rs,0.8.4
openSUSE:Factory/gstreamer-plugins-rs,19,xml-rs,0.8.4
openSUSE:Factory/lapce,13,xml-rs,0.8.4
openSUSE:Factory/ncspot,12,xml-rs,0.8.4
openSUSE:Factory/stl-thumb,2,xml-rs,0.8.4
openSUSE:Factory/swww,6,xml-rs,0.8.7
openSUSE:Factory/wayshot,6,xml-rs,0.8.4
openSUSE:Factory/wezterm,24,xml-rs,0.8.4
openSUSE:Factory/wl-clipboard-rs,1,xml-rs,0.8.4
openSUSE:Factory/wlgreet,7,xml-rs,0.8.4
Comment 2 Carlos López 2023-06-13 08:50:10 UTC 
(In reply to Thomas Leroy from comment #1)
> A vulnerable version of xml-rs crate is embedded is the following packages:
> ...

Actually this was introduced in 0.8.9:
https://github.com/netvl/xml-rs/pull/226#issuecomment-1588836538