CVE-2022-2309 NULL Pointer Dereference in lxml/lxml
Attackers can cause a denial of service via crafted XML input processed by the iterwalk function in lxml when used with specific libxml2 versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2309?
CVE-2022-2309 is a medium-severity vulnerability in Fedoraproject Fedora, published on 5 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
Weakness: CWE-476
Which versions are affected by CVE-2022-2309?
3 open source packages ship an affected version, including lxml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
lxml PyPI | All versions | 4.9.1 |
lxml PyPI | All versions | 4.9.1 |
lxml PyPI | All versions | 4.9.1 |
Linux distribution packages (22)
python3-lxml AlmaLinux:9 | All versions | 4.6.5-3.el9 |
python-lxml Red Hat:enterprise_linux:9::appstream | All versions | 0:4.6.5-3.el9 |
python-lxml-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:4.6.5-3.el9 |
python3-lxml Red Hat:enterprise_linux:9::appstream | All versions | 0:4.6.5-3.el9 |
python3-lxml-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:4.6.5-3.el9 |
python-lxml Rocky Linux:9 | All versions | 0:4.6.5-3.el9 |
python-lxml SUSE:Enterprise Storage 7 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Module for Public Cloud 15 | All versions | 4.7.1-150100.6.6.1 |
python-lxml SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Manager Proxy 4.1 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Manager Retail Branch Server 4.1 | All versions | 4.7.1-150200.3.10.1 |
python-lxml SUSE:Manager Server 4.1 | All versions | 4.7.1-150200.3.10.1 |
python-lxml openSUSE:Leap 15.3 | All versions | 4.7.1-150200.3.10.1 |
python-lxml openSUSE:Leap 15.4 | All versions | 4.7.1-150200.3.10.1 |
libxml2 openSUSE:Tumbleweed | All versions | 2.10.1-1.1 |
Products include Fedoraproject Fedora, Lxml Lxml.
How do I fix CVE-2022-2309?
Upgrade lxml to 4.9.1 or later.
Is CVE-2022-2309 being exploited?
There is no known exploitation of CVE-2022-2309 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2022-2309, ALSA-2022:8226, AZL-10058, AZL-10059, CLSA-2026-1779225366, CLSA-2026-1791271358 and 14 more.