Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 507
Alerts This Week
Warning Icon 1 507

Scientific Linux SL7: SLSA-2017:2492-1 Moderate: xmlsec1 DoS Risk

Calendar Aug 21, 2017 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Scientific Large Esm H446
Topics%20covered

Topics Covered

security advisory doS information disclosure libxml2 xmlsec1 Scientific Linux external entity
It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service. (CVE-2017-1000061) SL7 x86_64 xmlsec1-1.2.20-7.el7_4.i686.rpm xmlsec1-1.2.20-7.el7_4.x86_64.rpm xm [More...] 
Synopsis:          Moderate: xmlsec1 security update
Advisory ID:       SLSA-2017:2492-1
Issue Date:        2017-08-21
CVE Numbers:       CVE-2017-1000061
--

Security Fix(es):

* It was discovered xmlsec1's use of libxml2 inadvertently enabled
external entity expansion (XXE) along with validation. An attacker could
craft an XML file that would cause xmlsec1 to try and read local files or
HTTP/FTP URLs, leading to information disclosure or denial of service.
(CVE-2017-1000061)
--

SL7
  x86_64
    xmlsec1-1.2.20-7.el7_4.i686.rpm
    xmlsec1-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-debuginfo-1.2.20-7.el7_4.i686.rpm
    xmlsec1-debuginfo-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-openssl-1.2.20-7.el7_4.i686.rpm
    xmlsec1-openssl-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-devel-1.2.20-7.el7_4.i686.rpm
    xmlsec1-devel-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-gcrypt-1.2.20-7.el7_4.i686.rpm
    xmlsec1-gcrypt-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-gcrypt-devel-1.2.20-7.el7_4.i686.rpm
    xmlsec1-gcrypt-devel-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-gnutls-1.2.20-7.el7_4.i686.rpm
    xmlsec1-gnutls-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-gnutls-devel-1.2.20-7.el7_4.i686.rpm
    xmlsec1-gnutls-devel-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-nss-1.2.20-7.el7_4.i686.rpm
    xmlsec1-nss-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-nss-devel-1.2.20-7.el7_4.i686.rpm
    xmlsec1-nss-devel-1.2.20-7.el7_4.x86_64.rpm
    xmlsec1-openssl-devel-1.2.20-7.el7_4.i686.rpm
    xmlsec1-openssl-devel-1.2.20-7.el7_4.x86_64.rpm

- Scientific Linux Development Team