What’s Vulnerable › Vulnerabilities
CVE-2021-3517: Nokogiri contains libxml Out-of-bounds Write vulnerability
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 17.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-05-19 · updated 2026-10-14
- Weakness: CWE-787
Description
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Affected products
- Debian Linux: 9.0
- Fedoraproject Fedora: 33, 34
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- Clustered Data ONTAP: all versions
- NetApp Clustered Data Ontap Antivirus Connector: all versions
- E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
- NetApp E-Series Santricity Storage Manager: all versions
- NetApp E-Series Santricity Web Services: all versions
- NetApp Hci H410C Firmware: all versions
- NetApp Hci Management Node: all versions
- NetApp Manageability Software Development Kit: all versions
- OnCommand Insight: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp ONTAP Select Deploy administration utility: all versions
- NetApp Santricity Unified Manager: all versions
- NetApp Snapdrive: all versions
- SnapManager for Oracle: all versions
- NetApp Solidfire: all versions
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
- Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
- Oracle Corporation MySQL Workbench: through 8.0.26
- containers/openjdk: 8-update301
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
- Oracle Real User Experience Insight: 13.4.1.0, 13.5.1.0
- Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
- Red Hat Enterprise Linux: 8.0
- RedHat Jboss Core Services: all versions
- xmlsoft libxml2: before 2.9.11 — fixed in 2.9.11
- Rubygems Nokogiri: before 1.11.4; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+122) — fixed in 1.11.4
How to fix
Upgrade to a fixed version: xmlsoft libxml2 2.9.11; Rubygems Nokogiri 1.11.4. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1954232
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
- https://security.gentoo.org/glsa/202107-05
- https://security.netapp.com/advisory/ntap-20210625-0002/
- https://security.netapp.com/advisory/ntap-20211022-0004/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Get alerted when CVE-2021-3517 or the next vulnerability affects your stack