GitHub Advisoryadvisory · crates.io

GHSA-7gf7-jv65-wjmh xml-rs vulnerable to denial of service via invalid token in XML document

HIGH Published 2023-06-05 Modified 2025-01-08 Official page ↗
Aliases
CVE-2023-34411
Ecosystem
crates.io
Packages
xml-rs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611, CWE-617
Reviewed
2023-06-06

Affected packages

• crates.io xml-rs: >= 0.8.9, < 0.8.14 → fixed in 0.8.14

Description

The xml-rs crate >= 0.8.9 and < 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.

Related

Alias · CVE (1)

  • CVE-2023-34411 The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! vulnerability

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-617 Reachable Assertion weakness

References