CVE-2018-10868

CWE-400 — Uncontrolled Resource ConsumptionCWE-776 — XML Entity Expansion (Billion Laughs)5 documents5 sources
Severity
7.5HIGH
EPSS
1.2%
top 21.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Certification
Timeline
PublishedMay 26
Latest updateMay 24

Description

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5redhat-certificationredhat-certification 7

🔴Vulnerability Details

2
GHSA
GHSA-9gcv-g5q9-f633: It has been discovered that redhat-certification does not properly limit the number of recursive definitions of entities in XML documents while parsin↗2022-05-24
▶
CVEList
CVE-2018-10868: redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user t↗2021-05-26
▶

📋Vendor Advisories

1
Red Hat
redhat-certification: billion laugh attack when getting the status of a host↗2018-06-21
▶

💬Community

1
Bugzilla
CVE-2018-10868 redhat-certification: billion laugh attack when getting the status of a host↗2018-06-21
▶