critical9.1
CVE-2024-40896
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers …
Impact
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xmlsoft | Libxml2 | from 2.11.0 before 2.11.9 from 2.12.0 before 2.12.9 from 2.13.0 before 2.13.3 |
| Netapp | Hci Compute Node | All versions |
| Netapp | Solidfire \& Hci Management Node | All versions |
| Netapp | Solidfire \& Hci Storage Node | All versions |
| Netapp | H300s Firmware | All versions |
| Netapp | H410s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H700s Firmware | All versions |
| Netapp | H410c Firmware | All versions |