CVE-2024-50602: Medium severity NetApp Active Iq Unified Manager Vmware Vsphere vulnerability
Published Oct 27, 2024
·Updated
An issue was discovered in libexpat before 2.6.4. There is a crash within the XMLResumeParser function because XMLStopParser can stop/suspend an unstarted parser.
Affected Software
26 affected componentsFixes available
debian/expat<=2.2.10-2+deb11u5, <=2.2.10-2+deb11u6, <=2.5.0-1+deb12u1
2.6.4-1
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Solidfire \& Hci Management Node
NetApp Solidfire \& Hci Storage Node
NetApp Windows Host Utilities
Debian Debian Linux=11.0
NetApp Hci Compute Node
All of the following
NetApp H300s Firmware
NetApp H300s
All of the following
NetApp H500s Firmware
NetApp H500s
All of the following
NetApp H700s Firmware
NetApp H700s
All of the following
NetApp H410s Firmware
NetApp H410s
All of the following
NetApp H410c Firmware
NetApp H410c
Libexpat Project Libexpat<2.6.4
IBM Cloud Pak System<=2.3.4.0
IBM Cloud Pak System<=2.3.4.1
2.3.4.1 ifix1
IBM Cloud Pak System<=2.3.5.0
IBM Cloud Pak System<=2.3.6.0
IBM OS Image for Red Hat Linux Systems<=4.0.4.0
4.0.5.0
4.0.6.0
4.0.7.0
IBM OS Image for Red Hat Linux Systems<=5.0.0.0
5.0.1.0
Microsoft azl3 expat 2.6.3-2
Microsoft cbl2 expat 2.6.3-2
Event History
Oct 27, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via Red Hat·05:01 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 AM
Affected Software
Nov 9, 2024
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
DescriptionSeverity
Dec 10, 2024
Data Sourced
via Ubuntu·05:10 PM
RemedyDescriptionSeverityAffected Software
Jan 30, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-50602?
CVE-2024-50602 has a medium severity rating due to the potential for causing crashes during XML parsing.
2
How do I fix CVE-2024-50602?
To fix CVE-2024-50602, upgrade libexpat to version 2.6.4 or higher.
3
What software versions are affected by CVE-2024-50602?
CVE-2024-50602 affects versions of libexpat prior to 2.6.4, including 2.2.10-2+deb11u5, 2.2.10-2+deb11u6, and 2.5.0-1+deb12u1.
4
What kind of exploit is associated with CVE-2024-50602?
CVE-2024-50602 can be exploited to crash the application using libexpat when the XML_ResumeParser function is invoked improperly.
5
Is CVE-2024-50602 publicly disclosed?
Yes, CVE-2024-50602 has been publicly disclosed and is documented for security awareness.