← Back

CVE-2021-3541

nvd nist
Published: Jul 9, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Affected (19)

Show all products
Xmlsoft: Libxml2 · Redhat: Jboss Core Services · Oracle: Zfs Storage Appliance Kit · Netapp: Active Iq Unified Manager, Cloud Backup, Clustered Data Ontap, Clustered Data Ontap Antivirus Connector, Manageability Software Development Kit, Ontap Select Deploy Administration Utility, Smi S Provider, Snapdrive, H410c Firmware, H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware
Xmlsoft
1 product
Libxml2
Redhat
1 product
Jboss Core Services
Oracle
1 product
Zfs Storage Appliance Kit
Netapp
16 products
Active Iq Unified Manager
Cloud Backup
Clustered Data Ontap
Clustered Data Ontap Antivirus Connector
Manageability Software Development Kit
Ontap Select Deploy Administration Utility
Smi S Provider
Snapdrive
H410c Firmware
H300s Firmware
H500s Firmware
H700s Firmware
H300e Firmware
H500e Firmware
H700e Firmware
H410s Firmware
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Libxml2
Before 2.9.11
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Jboss Core Services
All versions
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Zfs Storage Appliance Kit
Version 8.8
Configuration D
8 vulnerable
Vulnerable SoftwareAffected Versions
Active Iq Unified Manager
All versions
Cloud Backup
All versions
Clustered Data Ontap
All versions
Clustered Data Ontap Antivirus Connector
All versions
Manageability Software Development Kit
All versions
Ontap Select Deploy Administration Utility
All versions
Smi S Provider
All versions
Snapdrive
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H410c Firmware
All versions
Running on/withPlatform Versions
Netapp
H410c
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H300s Firmware
All versions
Running on/withPlatform Versions
Netapp
H300s
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H500s Firmware
All versions
Running on/withPlatform Versions
Netapp
H500s
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H700s Firmware
All versions
Running on/withPlatform Versions
Netapp
H700s
All versions
Configuration I
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H300e Firmware
All versions
Running on/withPlatform Versions
Netapp
H300e
All versions
Configuration J
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H500e Firmware
All versions
Running on/withPlatform Versions
Netapp
H500e
All versions
Configuration K
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H700e Firmware
All versions
Running on/withPlatform Versions
Netapp
H700e
All versions
Configuration L
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
H410s Firmware
All versions
Running on/withPlatform Versions
Netapp
H410s
All versions

Related CWEs

CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (6)

Source: secalert@redhat.com
Issue TrackingPatchThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.