CVE-2022-39353
xmldom: Allows multiple root elements in a DOM tree
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Azure Linux. Rated lower by Red Hat (high), Ubuntu (medium).
Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | python-tensorboard | 0:2.16.2-1.azl3 |
| npm::GitHub Security Advisory npm | @xmldom/xmldom, xmldom | 0.7.7, 0.8.4, 0.9.0-beta.4 |
| chainguard | wazuh-dashboard, wazuh-dashboard-fips | 4.14.6-r3 and 1 more |
| debian 10 | node-xmldom | 0.1.27+ds-1+deb10u2 |
| debian 11 | node-xmldom | 0.5.0-1+deb11u2 |
| debian 12 | node-xmldom | 0.8.6-1 |
| debian 13 | node-xmldom | 0.8.6-1 |
| debian 14 | node-xmldom | 0.8.6-1 |
| echo | node-xmldom | 0.8.6-1 |
| rapidfort ubuntu 20.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
| rapidfort ubuntu 22.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
| rapidfort ubuntu 24.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
Show all 18 entries from 16 sources
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | python-tensorboard | 0:2.16.2-1.azl3 |
| npm::GitHub Security Advisory npm | @xmldom/xmldom | 0.7.7, 0.8.4, 0.9.0-beta.4 |
| npm::GitHub Security Advisory npm | xmldom | no fix listed |
| chainguard | wazuh-dashboard | 4.14.6-r3 |
| chainguard | wazuh-dashboard-fips | 4.14.6-r1 |
| debian 10 | node-xmldom | 0.1.27+ds-1+deb10u2 |
| debian 11 | node-xmldom | 0.5.0-1+deb11u2 |
| debian 12 | node-xmldom | 0.8.6-1 |
| debian 13 | node-xmldom | 0.8.6-1 |
| debian 14 | node-xmldom | 0.8.6-1 |
| echo | node-xmldom | 0.8.6-1 |
| rapidfort ubuntu 20.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
| rapidfort ubuntu 22.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
| rapidfort ubuntu 24.04 | node-xmldom | 0:0.7.5-1ubuntu0.22.04.1 |
| ubuntu 20.04 | node-xmldom | 0.1.27+ds-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | node-xmldom | 0.1.27+ds-1+deb10u2build0.20.04.1 |
| ubuntu 22.04 | node-xmldom | 0.7.5-1ubuntu0.22.04.1 |
| ubuntu 22.10 | node-xmldom | 0.7.5-1ubuntu0.22.10.1 |
References
- https://access.redhat.com/security/cve/CVE-2022-39353
- https://github.com/jindw/xmldom/issues/150
- https://github.com/xmldom/xmldom
- https://github.com/xmldom/xmldom/commit/52a708360c35aa160fcca8621720d71fd0f95f1a
- https://github.com/xmldom/xmldom/commit/7ff7c10ab2961703ac1752e95b4ff60ee4ee6643
- https://github.com/xmldom/xmldom/commit/c02f786216bed70825f9a351c65e61500f51e931
- https://github.com/xmldom/xmldom/releases/tag/0.7.7
- https://github.com/xmldom/xmldom/releases/tag/0.8.4
All 14 references
- https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4
- https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883
- https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-39353
- https://ubuntu.com/security/notices/USN-6102-1
- https://www.cve.org/CVERecord?id=CVE-2022-39353