NULL pointer dereference in Lxml
CVE-2022-2309
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
EPSS: 0.026 (84.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Lxml
- Lxml Lxml/lxml — versions unspecified
- Xmlsoft Libxml2
- Fedoraproject Fedora — versions 36, 37
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (x_refsource_CONFIRM, Exploit, Patch, Third Party Advisory, Issue Tracking)
- security@huntr.dev (Patch, Third Party Advisory, x_refsource_MISC)
- security@huntr.dev (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@huntr.dev (x_refsource_CONFIRM, Third Party Advisory)
- security@huntr.dev (x_refsource_FEDORA, vendor-advisory)
- security@huntr.dev (x_refsource_FEDORA, vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2022-2309?
- CVE-2022-2309 is a high-severity vulnerability in Lxml, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2022-07-05.
- How severe is CVE-2022-2309?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-2309 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.