XML External Entity injection in Libxml2 - CVE-2024-40896

Vulnerability identifier: #VU96997

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2024-40896

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Libxml2
Communications Unified Assurance
LANTIME Operating System Firmware (LTOS)
MySQL Workbench
Oracle HTTP Server
Oracle Communications Cloud Native Core Network Data Analytics Function
Slackware Linux
Anolis OS
openEuler
Ubuntu
Fedora
Oracle Communications Cloud Native Core Unified Data Repository
libxml2
libxml2-devel
python3-libxml2
libxml2-debuginfo
libxml2-debugsource
libxml2-help
libxml2-doc
libxml2-static
libxml2 (Ubuntu package)

Install updates from vendor's website.

Libxml2 - addressed in versions 2.11.9, 2.12.9, 2.13.3
LANTIME Operating System Firmware (LTOS) - update to 7.08.020
MySQL Workbench - update to 8.0.42
libxml2 - update to 2.11.5-4
libxml2-devel - update to 2.11.5-4
python3-libxml2 - update to 2.11.5-4
libxml2-debuginfo - update to 2.11.5-4
libxml2-debugsource - update to 2.11.5-4
libxml2-help - update to 2.11.5-4
libxml2-doc - update to 2.11.5-5
libxml2 - update to 2.11.5-5
libxml2-devel - update to 2.11.5-5
libxml2-static - update to 2.11.5-5
python3-libxml2 - update to 2.11.5-5
libxml2 - update to 2.11.9
libxml2 (Ubuntu package) - update to 2.12.7+dfsg-3ubuntu0.1
libxml2 - addressed in versions 2.12.9-1.fc40, 2.12.9-1.fc41

• https://gitlab.gnome.org/GNOME/libxml2/-/issues/761

• XML External Entity injection in Libxml2
• Slackware Linux update for libxml2
• openEuler 24.03 LTS update for libxml2
• Fedora 41 update for libxml2
• Fedora 40 update for libxml2
• Ubuntu update for libxml2
• Anolis OS update for libxml2
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in Oracle HTTP Server
• Multiple vulnerabilities in MySQL Workbench
• Meinberg LANTIME firmware update for third-party components (February 2025)