CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted...

7.1 HighFix available

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

1.35%Down 3.1 points since Apr 14, 2021

What each source reports

NVD Score used 7.1

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: CVE-2017-1000061
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:N/A:P
Weakness: CWE-611
Updated: 2026-11-02

CVE List No score

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: CVE-2017-1000061
Updated: 2026-11-02

EUVDEUVD-2017-1381 No score

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: EUVD-2017-1381
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jmhh-hg4r-g2c2 7.1

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted...

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: GHSA-jmhh-hg4r-g2c2
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSVBELL-CVE-2017-1000061 7.1

CVE-2017-1000061 does not affect BellSoft software

Record: BELL-CVE-2017-1000061
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV 7.1

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: CVE-2017-1000061
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2017-1000061 7.1

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: DEBIAN-CVE-2017-1000061
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2017:2492 6.5

Red Hat Security Advisory: xmlsec1 security update

Record: RHSA-2017:2492
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000061 7.1

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

Record: UBUNTU-CVE-2017-1000061
CVSS 3.0: 7.1 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2017-0305 No score

Updated xmlsec1 packages fix security vulnerability

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service (CVE-2017-1000061).

Record: MGASA-2017-0305
Updated: 2026-11-02

OSVMGASA-2020-0104 No score

Updated xmlsec1 packages fix security vulnerability

Updated xmlsec1 packages fix security vulnerability:

Record: MGASA-2020-0104
Updated: 2026-11-02

OSVUSN-5674-1 No score

xmlsec1 vulnerability

It was discovered that XML Security Library incorrectly handled certain input documents. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service.

Record: USN-5674-1
Updated: 2026-11-02

Affected products

xmlsec project xmlsec

Affected packages

Affected packages
Package	Affected	Fixed
`xmlsec1` Debian:12	before 1.2.24-1	1.2.24-1
`xmlsec1` Debian:13	before 1.2.24-1	1.2.24-1
`xmlsec1` Debian:14	before 1.2.24-1	1.2.24-1
`xmlsec1` Mageia:5	before 1.2.24-1.mga5	1.2.24-1.mga5
`xmlsec1` Mageia:6	before 1.2.24-1.mga6	1.2.24-1.mga6
`xmlsec1` Mageia:7	before 1.2.29-1.mga7	1.2.29-1.mga7
`xmlsec1` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-debuginfo` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-devel` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4

Show 42 moreShow less

Affected packages
Package	Affected	Fixed
`xmlsec1-gcrypt` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt-devel` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls-devel` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss-devel` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:7::client	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-debuginfo` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-devel` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt-devel` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls-devel` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss-devel` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:7::server	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gcrypt-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-gnutls-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-nss-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1-openssl-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.2.20-7.el7_4	0:1.2.20-7.el7_4
`xmlsec1` Ubuntu:Pro:14.04:LTS	before 1.2.18-2ubuntu1+esm1, plus listed versions 1.2.18-21.2.18-2ubuntu1	1.2.18-2ubuntu1+esm1
`xmlsec1` Ubuntu:Pro:16.04:LTS	before 1.2.20-2ubuntu4+esm1, plus listed versions 1.2.20-2ubuntu31.2.20-2ubuntu4	1.2.20-2ubuntu4+esm1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000061 is a high vulnerability (CVSS 7.1) in Xmlsec Project Xmlsec, published July 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in xmlsec1 1.2.24-1.

References

Show 15 moreShow less