RHSA-2020:3952: Moderate: expat security update
Expat is a C library for parsing XML documents.Security Fix(es): expat: large number of colons in input makes parser consume high amount of resources, leading to DoS (CVE-2018-20843) expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:3952?
The severity of RHSA-2020:3952 is categorized as moderate.
How do I fix RHSA-2020:3952?
To fix RHSA-2020:3952, you need to update the expat package to version 2.1.0-12.el7 or later.
What vulnerabilities are addressed in RHSA-2020:3952?
RHSA-2020:3952 addresses a denial of service vulnerability and a heap-based buffer over-read vulnerability in the expat C library.
Which versions of expat are affected by RHSA-2020:3952?
Versions of expat prior to 2.1.0-12.el7 are affected by RHSA-2020:3952.
Is there a need to restart services after applying RHSA-2020:3952?
Yes, after applying RHSA-2020:3952, it is advisable to restart any services that depend on the expat library.