CVE-2018-20843: XEE
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Other sources
It was discovered that the "setElementTypePrefix()" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service.
libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to consume all available CPU resources.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-20843?
CVE-2018-20843 has been classified as a high-severity vulnerability due to its potential to cause denial-of-service attacks by consuming excessive resources.
How do I fix CVE-2018-20843?
To fix CVE-2018-20843, update your libexpat version to 2.2.7 or later as recommended by your software provider.
What software is affected by CVE-2018-20843?
CVE-2018-20843 affects several versions of libexpat, particularly versions prior to 2.2.7, along with specific Red Hat packages like jbcs-httpd24-curl and jbcs-httpd24-httpd.
What are the symptoms of CVE-2018-20843 exploitation?
Exploitation of CVE-2018-20843 may result in the XML parser consuming high amounts of RAM and CPU resources, leading to performance degradation or application crashes.
Is CVE-2018-20843 present in my system?
To determine if CVE-2018-20843 is present in your system, check the version of the libexpat library and any affected software packages installed.