Summary
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.
Security Fix(es):
* libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | xmlrpc-c | 1.51.0-11.el8_10 |
| AlmaLinux · 8 | xmlrpc-c-c++ | 1.51.0-11.el8_10 |
| AlmaLinux · 8 | xmlrpc-c-client | 1.51.0-11.el8_10 |
| AlmaLinux · 8 | xmlrpc-c-client++ | 1.51.0-11.el8_10 |
| AlmaLinux · 8 | xmlrpc-c-devel | 1.51.0-11.el8_10 |
Vulnerabilities 1
-
High 7.5CVE-2024-8176 Public exploit
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …