What’s Vulnerable › Vulnerabilities

CVE-2024-28757

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-10 · updated 2026-10-15
• Weakness: CWE-776

Description

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

Affected products

• Fedoraproject Fedora: 38, 39, 40
• libexpat project libexpat: before 2.6.2 — fixed in 2.6.2
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H610C Firmware: all versions
• NetApp H610S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp ONTAP 9: 9
• NetApp Ontap Tools: 10
• NetApp Windows Host Utilities: all versions

How to fix

Upgrade to a fixed version: libexpat project libexpat 2.6.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/03/15/1
• https://github.com/libexpat/libexpat/issues/839
• https://github.com/libexpat/libexpat/pull/842
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/
• https://security.netapp.com/advisory/ntap-20240322-0001/
• http://www.openwall.com/lists/oss-security/2024/03/15/1
• https://github.com/libexpat/libexpat/issues/839
• https://github.com/libexpat/libexpat/pull/842
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/

Get alerted when CVE-2024-28757 or the next vulnerability affects your stack