| Package | Affected versions | Patched versions |
|---|---|---|
| libexpat | < 2.1.0 | 2.1.0 |
| python | ≥ 2.6.0, < 2.6.8≥ 2.7.0, < 2.7.3≥ 3.1.0, < 3.1.5≥ 3.2.0, < 3.2.3 | 2.6.82.7.33.1.53.2.3 |
| storage | = 2.0 |
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free