{"id":"CVE-2017-1000061","aliases":["BELL-CVE-2017-1000061","DEBIAN-CVE-2017-1000061","EUVD-2017-1381","GHSA-jmhh-hg4r-g2c2","MGASA-2017-0305","MGASA-2020-0104","RHSA-2017:2492","UBUNTU-CVE-2017-1000061","USN-5674-1"],"status":"published","title":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted...","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01352,"percentile":0.71745,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2017-07-13T20:00:00Z","modified":"2026-10-20T10:48:10Z","fixes":[{"ecosystem":"Debian:12","package":"xmlsec1","fixed_in":["1.2.24-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmlsec1","fixed_in":["1.2.24-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmlsec1","fixed_in":["1.2.24-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"xmlsec1","fixed_in":["1.2.24-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"xmlsec1","fixed_in":["1.2.24-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"xmlsec1","fixed_in":["1.2.29-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-openssl","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gcrypt","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gcrypt-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gnutls","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-nss","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-openssl","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gcrypt","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gcrypt-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gnutls","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-nss","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-openssl","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gcrypt","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gcrypt-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gnutls","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-nss","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-debuginfo","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-openssl","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gcrypt","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gcrypt-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gnutls","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gnutls-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-nss","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-nss-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-openssl-devel","fixed_in":["0:1.2.20-7.el7_4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlsec1","fixed_in":["1.2.18-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlsec1","fixed_in":["1.2.20-2ubuntu4+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.29-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xmlsec1-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-7.el7_4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.18-2ubuntu1+esm1"}]}],"versions":["1.2.18-2","1.2.18-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-2ubuntu4+esm1"}]}],"versions":["1.2.20-2ubuntu3","1.2.20-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlsec1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-2ubuntu4+esm1"}]}],"versions":["1.2.20-2ubuntu3","1.2.20-2ubuntu4"]}],"products":[{"vendor":"xmlsec_project","product":"xmlsec"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2492","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/lsh123/xmlsec/issues/43","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000061","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR"},{"url":"https://github.com/advisories/GHSA-jmhh-hg4r-g2c2"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-1000061","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000061","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0305.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21586","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2020-0104.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26174","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3PWHBRWXR3RNPHDSTQI6UWDG5ETOQ7VR/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1437311","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2492.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-1000061","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000061","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000061","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5674-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06.219Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-1381","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-13T20:00:00Z","modified":"2024-08-05T21:53:06Z","updated_at":"2026-11-03T02:23:04.143753Z"}],"ghsa":[{"id":"GHSA-jmhh-hg4r-g2c2","title":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted...","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2022-05-13T01:09:33Z","modified":"2025-04-20T03:41:51Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:01:49.006624Z"}],"nvd":[{"id":"CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-17T13:18:17.923Z","modified":"2026-06-17T00:58:40.05Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"BELL-CVE-2017-1000061","title":"CVE-2017-1000061 does not affect BellSoft software","status":"withdrawn","published":"2017-07-17T13:18:00Z","modified":"2026-01-26T09:45:47.242536Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-17T13:18:17.923Z","modified":"2026-10-20T10:48:10.764127987Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-17T13:18:17.923Z","modified":"2026-09-01T20:03:40.380466966Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"RHSA-2017:2492","title":"Red Hat Security Advisory: xmlsec1 security update","status":"published","published":"2024-09-16T00:27:36Z","modified":"2026-06-26T12:22:01.284654191Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-1000061","description":"xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service","status":"published","published":"2017-07-17T13:18:00Z","modified":"2026-04-22T11:09:07.370979Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2017-0305","title":"Updated xmlsec1 packages fix security vulnerability","description":"It was discovered xmlsec1's use of libxml2 inadvertently enabled\nexternal entity expansion (XXE) along with validation. An attacker could\ncraft an XML file that would cause xmlsec1 to try and read local files\nor HTTP/FTP URLs, leading to information disclosure or denial of service\n(CVE-2017-1000061).\n","status":"published","published":"2017-08-24T21:18:23Z","modified":"2026-04-16T06:25:03.318935357Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2020-0104","title":"Updated xmlsec1 packages fix security vulnerability","description":"Updated xmlsec1 packages fix security vulnerability:\n\nIt was discovered xmlsec1's use of libxml2 inadvertently enabled external\nentity expansion (XXE) along with validation. An attacker could craft an\nXML file that would cause xmlsec1 to try and read local files or HTTP/FTP\nURLs, leading to information disclosure or denial of service\n(CVE-2017-1000061).\n","status":"published","published":"2020-02-26T10:21:01Z","modified":"2026-04-16T04:44:38.289242323Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-5674-1","title":"xmlsec1 vulnerability","description":"It was discovered that XML Security Library incorrectly handled certain\ninput documents. An attacker could possibly use this issue to obtain\nsensitive information or cause a denial of service.\n","status":"published","published":"2022-10-13T14:06:12Z","modified":"2026-06-25T13:31:30.053516834Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}