Synopsis

Moderate: expat security update

Type/Severity

Security Advisory: Moderate

Topic

An update for expat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: large number of colons in input makes parser consume high amount of resources, leading to DoS (CVE-2018-20843)
  
• expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

• BZ - 1723723 - CVE-2018-20843 expat: large number of colons in input makes parser consume high amount of resources, leading to DoS
• BZ - 1752592 - CVE-2019-15903 expat: heap-based buffer over-read via crafted XML input

CVEs

• CVE-2018-20843
• CVE-2019-15903

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index

Red Hat Enterprise Linux Server 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
x86_64
expat-2.1.0-12.el7.i686.rpm	SHA-256: f89d48072e94b7aea6184f79f18ceafa755fa664a5811015e435685d88f5f8e0
expat-2.1.0-12.el7.x86_64.rpm	SHA-256: fb9878feb857be5b29d802cab4982689c32df47f63a9a3b7f2fc33e2886ad323
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-devel-2.1.0-12.el7.i686.rpm	SHA-256: e1c4b6540b2261c84f8cdacdf79d5952c3aac0b797d4238c56fd9c11c96d66c2
expat-devel-2.1.0-12.el7.x86_64.rpm	SHA-256: 104da68c1753c59e564abb699ac52aae4667ec45f447744a9d73f51dc30a5d24
expat-static-2.1.0-12.el7.i686.rpm	SHA-256: 8231747f4ad14beb18dbfd6b7108d31f2fdae65c9251e97a6cf8cda36e5c8f33
expat-static-2.1.0-12.el7.x86_64.rpm	SHA-256: 4cc603d6a5a7dfbea785e48d01b1c5208223fe5bd8d3ce3d14f8a2c32f816cda

Red Hat Enterprise Linux Workstation 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
x86_64
expat-2.1.0-12.el7.i686.rpm	SHA-256: f89d48072e94b7aea6184f79f18ceafa755fa664a5811015e435685d88f5f8e0
expat-2.1.0-12.el7.x86_64.rpm	SHA-256: fb9878feb857be5b29d802cab4982689c32df47f63a9a3b7f2fc33e2886ad323
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-devel-2.1.0-12.el7.i686.rpm	SHA-256: e1c4b6540b2261c84f8cdacdf79d5952c3aac0b797d4238c56fd9c11c96d66c2
expat-devel-2.1.0-12.el7.x86_64.rpm	SHA-256: 104da68c1753c59e564abb699ac52aae4667ec45f447744a9d73f51dc30a5d24
expat-static-2.1.0-12.el7.i686.rpm	SHA-256: 8231747f4ad14beb18dbfd6b7108d31f2fdae65c9251e97a6cf8cda36e5c8f33
expat-static-2.1.0-12.el7.x86_64.rpm	SHA-256: 4cc603d6a5a7dfbea785e48d01b1c5208223fe5bd8d3ce3d14f8a2c32f816cda

Red Hat Enterprise Linux Desktop 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
x86_64
expat-2.1.0-12.el7.i686.rpm	SHA-256: f89d48072e94b7aea6184f79f18ceafa755fa664a5811015e435685d88f5f8e0
expat-2.1.0-12.el7.x86_64.rpm	SHA-256: fb9878feb857be5b29d802cab4982689c32df47f63a9a3b7f2fc33e2886ad323
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-devel-2.1.0-12.el7.i686.rpm	SHA-256: e1c4b6540b2261c84f8cdacdf79d5952c3aac0b797d4238c56fd9c11c96d66c2
expat-devel-2.1.0-12.el7.x86_64.rpm	SHA-256: 104da68c1753c59e564abb699ac52aae4667ec45f447744a9d73f51dc30a5d24
expat-static-2.1.0-12.el7.i686.rpm	SHA-256: 8231747f4ad14beb18dbfd6b7108d31f2fdae65c9251e97a6cf8cda36e5c8f33
expat-static-2.1.0-12.el7.x86_64.rpm	SHA-256: 4cc603d6a5a7dfbea785e48d01b1c5208223fe5bd8d3ce3d14f8a2c32f816cda

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
s390x
expat-2.1.0-12.el7.s390.rpm	SHA-256: 8ce8238c195f66293974aa293955e2f69fef06e66dc03232947bbf18adb913a4
expat-2.1.0-12.el7.s390x.rpm	SHA-256: 6a64f12857c20a0125158d2bbc579c68b662392b30215ef1b97ff1b1f8aa5083
expat-debuginfo-2.1.0-12.el7.s390.rpm	SHA-256: e6bd713fccce0bbc90d4265432403e95fb6e61408bdfbeeae59c81cd61275106
expat-debuginfo-2.1.0-12.el7.s390.rpm	SHA-256: e6bd713fccce0bbc90d4265432403e95fb6e61408bdfbeeae59c81cd61275106
expat-debuginfo-2.1.0-12.el7.s390x.rpm	SHA-256: c022778b84d7b2d0e27fc22ddae2c04f24cf99c6b61265d5c86edd949b28a700
expat-debuginfo-2.1.0-12.el7.s390x.rpm	SHA-256: c022778b84d7b2d0e27fc22ddae2c04f24cf99c6b61265d5c86edd949b28a700
expat-devel-2.1.0-12.el7.s390.rpm	SHA-256: 2d41e61930280d6dbfb0a17784673954078a23fa985ab11a9dcd3cecad44cda6
expat-devel-2.1.0-12.el7.s390x.rpm	SHA-256: 5f46df931db230f2e554e6a7220470dfe4a92ad0fd139bf9418876e099419904
expat-static-2.1.0-12.el7.s390.rpm	SHA-256: 15c5184a93014beaa1cfcff20417427a890922805eb17009a52dfa176300968e
expat-static-2.1.0-12.el7.s390x.rpm	SHA-256: b8c5372833aff93559b01227ea76361337a80c34ad249944d358286f03eb6e6e

Red Hat Enterprise Linux for Power, big endian 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
ppc64
expat-2.1.0-12.el7.ppc.rpm	SHA-256: 7e22ac9527c13ffd6aa37baeb3e56729b67554f592642fa0a0109592f40cb81b
expat-2.1.0-12.el7.ppc64.rpm	SHA-256: b00a7a3ec9680103f97eee4dce9771b0f5f75cbab5a5bf55ae06fc145037e731
expat-debuginfo-2.1.0-12.el7.ppc.rpm	SHA-256: ce1fbb178754236dc381fb2a714cf814a32cb24d62d03fcf88129a2ddfe69fd6
expat-debuginfo-2.1.0-12.el7.ppc.rpm	SHA-256: ce1fbb178754236dc381fb2a714cf814a32cb24d62d03fcf88129a2ddfe69fd6
expat-debuginfo-2.1.0-12.el7.ppc64.rpm	SHA-256: e7f323ab3802fe8e1ab02f594398e61ce67d4eb393909b81350a00f078548091
expat-debuginfo-2.1.0-12.el7.ppc64.rpm	SHA-256: e7f323ab3802fe8e1ab02f594398e61ce67d4eb393909b81350a00f078548091
expat-devel-2.1.0-12.el7.ppc.rpm	SHA-256: b2b3386e3bca3b8b23fe16837405021896180fe2518ad067a85c94734dcdb002
expat-devel-2.1.0-12.el7.ppc64.rpm	SHA-256: 954ae5ad53e45ae404b88147c6383b8ba520f39b789f939d9f15b7806be2a96f
expat-static-2.1.0-12.el7.ppc.rpm	SHA-256: 6db006cabc95f64c4cf23f5394cc7b3d5989c68e0f60bbb8a068c8631be112c4
expat-static-2.1.0-12.el7.ppc64.rpm	SHA-256: 2602bf939492f97073d9ac3e79676dbc193625b33d58ad291f03c2f75c48fc46

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
x86_64
expat-2.1.0-12.el7.i686.rpm	SHA-256: f89d48072e94b7aea6184f79f18ceafa755fa664a5811015e435685d88f5f8e0
expat-2.1.0-12.el7.x86_64.rpm	SHA-256: fb9878feb857be5b29d802cab4982689c32df47f63a9a3b7f2fc33e2886ad323
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.i686.rpm	SHA-256: acedcef85d43ae73a1e1e4b3d2ef4de981c22ac21e8368d1cb95540522cf37f2
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-debuginfo-2.1.0-12.el7.x86_64.rpm	SHA-256: 3746cc9dfa080b395c9ddc4331c4015484df79ed88f1ac3e2a1a04b0bba7c073
expat-devel-2.1.0-12.el7.i686.rpm	SHA-256: e1c4b6540b2261c84f8cdacdf79d5952c3aac0b797d4238c56fd9c11c96d66c2
expat-devel-2.1.0-12.el7.x86_64.rpm	SHA-256: 104da68c1753c59e564abb699ac52aae4667ec45f447744a9d73f51dc30a5d24
expat-static-2.1.0-12.el7.i686.rpm	SHA-256: 8231747f4ad14beb18dbfd6b7108d31f2fdae65c9251e97a6cf8cda36e5c8f33
expat-static-2.1.0-12.el7.x86_64.rpm	SHA-256: 4cc603d6a5a7dfbea785e48d01b1c5208223fe5bd8d3ce3d14f8a2c32f816cda

Red Hat Enterprise Linux for Power, little endian 7

SRPM
expat-2.1.0-12.el7.src.rpm	SHA-256: d108c3053ad816981b658ec464e68c7694571b70aa71b3144ae01d625f104eb9
ppc64le
expat-2.1.0-12.el7.ppc64le.rpm	SHA-256: 9adc88ccf5365f29d49260b0e08b8dde6068033591a4fcd4a454284371fe4dbd
expat-debuginfo-2.1.0-12.el7.ppc64le.rpm	SHA-256: 1df645b2bf19bc06f8b86882c975037e7565c04704b61f64b67960c1a9fc06f2
expat-debuginfo-2.1.0-12.el7.ppc64le.rpm	SHA-256: 1df645b2bf19bc06f8b86882c975037e7565c04704b61f64b67960c1a9fc06f2
expat-devel-2.1.0-12.el7.ppc64le.rpm	SHA-256: 26b678751a31853c123b629b04345aadc4d4877d0aeaad6eecf047e31a3f2f2d
expat-static-2.1.0-12.el7.ppc64le.rpm	SHA-256: beacfdc723bd7d21be145a4bb56092da0489e4f5ae34267ff80866f38aa4c65c