CVE-2023-34411 (High) detected in xml-rs-0.8.0.crate

[mend-bolt-for-github]

CVE-2023-34411 - High Severity Vulnerability

Vulnerable Library - xml-rs-0.8.0.crate

An XML library in pure Rust

Library home page: https://crates.io/api/v1/crates/xml-rs/0.8.0/download

Path to dependency file: /third_party/rust_crates/Cargo.toml

Path to vulnerable library: /third_party/rust_crates/Cargo.toml

Dependency Hierarchy:

• ❌ xml-rs-0.8.0.crate (Vulnerable Library)

Found in HEAD commit: 4ec0c406a28f193fe6e7376ee7696cca0532d4ba

Found in base branch: master

Vulnerability Details

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.

Publish Date: 2023-06-05

URL: CVE-2023-34411

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-34411

Release Date: 2023-06-05

Fix Resolution: xml-rs - 0.8.14

---

Step up your Open Source Security Game with Mend here