CVE-2021-21366
published 2021-03-12CVE-2021-21366: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly…
PriorityP422medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
1.33%
67.8th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-xmldom | < node-xmldom 0.5.0-1 (bookworm) | node-xmldom 0.5.0-1 (bookworm) |
| xmldom | xmldom | < 0.5.0 | 0.5.0 |
| xmldom | xmldom | >= 0 < 0.5.0 | 0.5.0 |
| xmldom_project | xmldom | < 0.5.0 | 0.5.0 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
node-xmldom vulnerabilities
osv·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] node-xmldom vulnerabilities
node-xmldom vulnerabilities
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
GHSA
Misinterpretation of malicious XML input
ghsa·2021-03-12
CVE-2021-21366 [MEDIUM] CWE-115 Misinterpretation of malicious XML input
Misinterpretation of malicious XML input
### Impact
xmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
### Patches
Update to 0.5.0 (once it is released)
### Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
### References
Similar to this one reported on the Go standard library:
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
### For
OSV
Misinterpretation of malicious XML input
osv·2021-03-12
CVE-2021-21366 [MEDIUM] Misinterpretation of malicious XML input
Misinterpretation of malicious XML input
### Impact
xmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
### Patches
Update to 0.5.0 (once it is released)
### Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
### References
Similar to this one reported on the Go standard library:
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
### For
OSV
CVE-2021-21366: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
osv·2021-03-12·CVSS 4.3
CVE-2021-21366 [MEDIUM] CVE-2021-21366: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Ubuntu
xmldom vulnerabilities
vendor_ubuntu·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] xmldom vulnerabilities
Title: xmldom vulnerabilities
Summary: Several security issues were fixed in xmldom.
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
xmldom: incorrect parsing and serialization leads to unexpected behavior
vendor_redhat·2023-03-12·CVSS 4.3
CVE-2021-21366 [MEDIUM] xmldom: incorrect parsing and serialization leads to unexpected behavior
xmldom: incorrect parsing and serialization leads to unexpected behavior
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Package: openshift3/ose-console (Red Hat OpenShift Container Platform 3.11) - Not affected
Package: openshift4/ose-console (Red Hat OpenShift Container Platform 4) - Not affected
Debian
CVE-2021-21366: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser ...
vendor_debian·2021·CVSS 4.3
CVE-2021-21366 [MEDIUM] CVE-2021-21366: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser ...
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Scope: local
bookworm: resolved (fixed in 0.5.0-1)
bullseye: resolved (fixed in 0.5.0-1)
forky: resolved (fixed in 0.5.0-1)
sid: resolved (fixed in 0.5.0-1)
trixie: resolved (fixed in 0.5.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135https://github.com/xmldom/xmldom/releases/tag/0.5.0https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfvhttps://lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlhttps://www.npmjs.com/package/xmldomhttps://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135https://github.com/xmldom/xmldom/releases/tag/0.5.0https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfvhttps://lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlhttps://www.npmjs.com/package/xmldom
2021-03-12
Published