What is CVE-2021-3517?

CVE-2021-3517 is a high-severity vulnerability in the XML entity encoding functionality of libxml2 versions before 2.9.11. This flaw allows an attacker to trigger an out-of-bounds read by supplying a crafted file to an application using the affected functionality. The vulnerability impacts many systems, including Linux-based operating systems and various software products that use libxml2 for XML processing.

Who is impacted by CVE-2021-3517?

CVE-2021-3517 affects users of applications linked with libxml2 versions before 2.9.11, including Red Hat Enterprise Linux 8, Red Hat JBoss Core Services, and the BookKeeper 4.12.1 docker image with CentOS 7. The flaw impacts many systems, including Linux-based operating systems and various software products that use libxml2 for XML processing. It is crucial for users to update to newer versions to mitigate this vulnerability.

What to do if CVE-2021-3517 affected you

If you're affected by the CVE-2021-3517 vulnerability, it's crucial to take action to protect your systems. Here's a simplified list of steps to follow:

1. Update to the fixed version of libxml2 (2.9.11)

2. Upgrade affected systems, such as CentOS 7, to a more secure version like CentOS 8

3. Monitor the CVE page for updates

4. Check for product-specific updates and advisories

By following these steps, you can help mitigate the risks associated with this vulnerability and keep your systems secure.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2021-3517 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. To mitigate this high-severity flaw affecting libxml2's XML entity encoding functionality, users should update libxml2 to version 2.9.11 or later. This will help protect against potential out-of-bounds read attacks and maintain the security of affected systems.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, an out-of-bounds write issue in libxml2's XML entity encoding functionality.

Learn More

For more information about the CVE-2021-3517 vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or links below.

• NVD - CVE-2021-3517

• Red Hat Product Errata

• GitBox (timjbutler)

• Debian Security Update