CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.(CVE-2023-52425)

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.

Security Fix(es):

• expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)
• expat: XML Entity Expansion (CVE-2024-28757)

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.

Security Fix(es):

• expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

• CVE-2023-52425: fix reparsings for large token to prevent DoS

• CVE-2023-52425: fix reparsings for large token to prevent DoS

• CVE-2023-52425: fix reparsings for large token to prevent DoS

• CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
• CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
• CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
• CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)

• CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
• CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
• CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
• CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)

• CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
• CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
• CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
• CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)

• SECURITY UPDATE: quadratic re-parsing DoS with large tokens
  • debian/patches/CVE-2023-52425.patch: add callProcessor() wrapper with reparse deferral heuristic in expat/lib/xmlparse.c, add XML_SetReparseDeferralEnabled() API in expat/lib/expat.h.
  • CVE-2023-52425

It was discovered that Expat could be made to consume large amounts of resources. If a user or automated system were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service. (CVE-2023-52425, CVE-2024-28757)

These are all security issues fixed in the expat-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-3.11.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-3.12.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-2.7.18-46.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-3.13.0~b3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python314-3.14.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the clustershell-1.9.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python315-3.15.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python316-3.16.0~a1-1.1 package on the GA media of openSUSE Tumbleweed.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python39 fixes the following issues:

• CVE-2023-52425: Fixed denial of service (resource consumption) caused by processing large tokens in expat (bsc#1219559).
• CVE-2023-6597: Fixed symlink race condition in tempfile.TemporaryDirectory (bsc#1219666).
• CVE-2024-0450: Fixed 'quoted-overlap' in zipfile module (bsc#1221854).

The following non-security bugs were fixed:

• Use the system-wide crypto-policies (bsc#1211301).

This update for expat fixes the following issues:

• CVE-2023-52425: Fixed a DoS caused by processing large tokens. (bsc#1219559)
• CVE-2024-28757: Fixed an XML Entity Expansion. (bsc#1221289)

This update for expat fixes the following issues:

• CVE-2023-52425: Fixed a DoS caused by processing large tokens. (bsc#1219559)
• CVE-2024-28757: Fixed an XML Entity Expansion. (bsc#1221289)

This update for python310 fixes the following issues:

• CVE-2024-0450: Fixed 'quoted-overlap' in zipfile module is python310 (bsc#1221854)

• CVE-2023-52425: Fixed denial of service caused by processing large tokens in expat module in python310 (bsc#1219559)

• CVE-2023-6597: Fixed tempfile.TemporaryDirectory fails on removing dir in some edge cases related to symlinks in python310 (bsc#1219666)

  Other changes:

• Revert %autopatch due to missing parameter support (bsc#1189495)

• Extended crypto-policies support (bsc#1211301)

This update for python311 fixes the following issues:

• CVE-2024-0450: Fixed 'quoted-overlap' issue inside the zipfile module (bsc#1221854).
• CVE-2023-6597: Fixed removing tempfile.TemporaryDirectory in some edge cases related to symlinks (bsc#1219666).
• CVE-2023-52425: Fixed denial of service (resource consumption) caused by processing large tokens (bsc#1219559).

Bug fixes:

• Eliminate ResourceWarning which broke the test suite in test_asyncio (bsc#1221260).
• Revert use of %autopatch (bsc#1189495).
• Use the system-wide crypto-policies (bsc#1211301).