CVE-2018-20843 Denial of service in n/a
Attackers can cause denial of service by sending XML with many colons, exhausting resources in the Expat library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20843?
CVE-2018-20843 is a high-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 24 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Weakness: CWE-611
Which versions are affected by CVE-2018-20843?
It affects 9 products.
Linux distribution packages (15)
mingw32-expat AlmaLinux:8 | All versions | 2.2.4-5.el8 |
mingw64-expat AlmaLinux:8 | All versions | 2.2.4-5.el8 |
mingw-expat Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.4-5.el8 |
mingw32-expat Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.4-5.el8 |
mingw32-expat-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.4-5.el8 |
mingw64-expat Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.4-5.el8 |
mingw64-expat-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.2.4-5.el8 |
expat SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 2.1.0-21.6.1 |
expat SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.2.5-3.3.1 |
expat SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.2.5-3.3.1 |
expat SUSE:Linux Enterprise Server 12 SP4 | All versions | 2.1.0-21.6.1 |
expat SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 2.1.0-21.6.1 |
expat SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 2.1.0-21.6.1 |
expat openSUSE:Leap 15.0 | All versions | 2.2.5-lp151.3.3.1 |
expat openSUSE:Leap 15.1 | All versions | 2.2.5-lp151.3.3.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Libexpat Project Libexpat, Opensuse Leap, Oracle Hospitality Res 3700 and 3 more.
How do I fix CVE-2018-20843?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20843 being exploited?
There is no known exploitation of CVE-2018-20843 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-20843, ALSA-2020:4846, CLEANSTART-2026-ZY15804, DEBIAN-CVE-2018-20843, DLA-1839-1, DSA-4472-1 and 9 more.