High severity · published Dec 18, 2022
CVE-2021-4249
A vulnerability was found in xml-conduit
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XM
Xml-conduit · Haskell
before 1.9.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4249
Patch
https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea
Patch
https://github.com/snoyberg/xml/pull/161
Release Notes
https://hackage.haskell.org/package/xml-conduit-1.9.1.0
Third Party Advisory
https://vuldb.com/?id.216204