Use-After-Free in libxslt (xsltGetInheritedNsList)
CVE: CVE-2024-55549
Component: libxslt
CWE: CWE-416
Severity: Important
CVSS v3: 7.8/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in libxslt. This vulnerability allows an attacker to trigger a use-after-free issue by excluding result prefixes.

Statement: This use-after-free vulnerability in libxslt marked as Important rather than a Moderate flaw, due to its potential to enable arbitrary code execution or cause denial-of-service conditions. The vulnerability arises from mishandled memory in the exclPrefixTab table, which references freed namespace URLs during stylesheet processing. When an included stylesheet has xsl:text as the root and is deleted, the associated namespace URLs remain referenced in exclPrefixTab despite being freed, leading to a classic use-after-free condition. Since libxslt is a core XML transformation library frequently used in complex server-side applications (e.g., web frameworks, document rendering), an attacker can craft malicious XSLT stylesheets to exploit this flaw, potentially gaining remote code execution within the application's process.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

     https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:753e18b761de2e56bdf29b56665c33624f1c27d7cfa0b6b5c081bcc3b035c864

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
     https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:2f46021d7977a7211e043834bda0a0fd728e04cdc7c7b657aa1f51ee7a1fbf34

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:66bd4e160209b4e7add5514498c4889812b76fa2786d1219d7d2152eea1b4f1c

(For s390x architecture)
The image digest is sha256:9a56729c25596d90c228f04d5e4b5080a3921a325e0c768da51b81b6a032cf07

(For ppc64le architecture)
The image digest is sha256:078d5b2c3ce7ed409c454c01113e6171a8852f434069c1f8565e4a310b8e00b5

(For aarch64 architecture)
The image digest is sha256:b1e60833e9535efa25a4e42efe461e6c0c9b7fcea4a499428bdee7577884f0cf

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f0421eafd1ab27c694f6bfc6ec8a8641636030485a3a4c80071ce7fa1a1bf04c

      (For s390x architecture)
      The image digest is sha256:49188f681f854dda12f1c3e72b5066d957f5903705ca6d060bb54399838272e3

      (For ppc64le architecture)
      The image digest is sha256:4e464e5377d636c2f14838b0965af486949b410a31be742b7ca2e5116954d304

      (For aarch64 architecture)
      The image digest is sha256:06f68ebf40881e9c7e29b94883a840e1119ed104e33676d2c15f5ad066339306

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9871f990d9f956d735e85e2040101377d5fd7cc4e62e8f54feb62650190216c9

      (For s390x architecture)
      The image digest is sha256:851bac58b8ba11752792467aca680d41a1b306ba9e4973dca4b79d4adba93e55

      (For ppc64le architecture)
      The image digest is sha256:cbd719c4e8627d894621ffbfca8adc31669ccfd63411889b58810111bcf34b00

      (For aarch64 architecture)
      The image digest is sha256:9cd61312dbd5619bed52ea20afb0fb6b6634f4c76394fea5b5187fc4083e8027

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16]/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:035baf97e4c715fc1afb681a9f789d99ebaf568b2656584d59f72962e0d14bcd

      (For s390x architecture)
      The image digest is sha256:ae63030ebb847f17ac0d2273f55d5db43df6b9f324197573bd9d2fbb7403036a

      (For ppc64le architecture)
      The image digest is sha256:c693db40e8d19847cd4bce1541344cc93d828221c029dc7ddeee4c829a351a12

      (For aarch64 architecture)
      The image digest is sha256:61a46e56e230e5869af207484585a5e61141e322d539616422ec7e61bc4ad137

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:31e8978d1f7a24c3e70dcc12c93dd5e73311b78e528f73beb020ddbe3270e07d

      (For s390x architecture)
      The image digest is sha256:7e6a77a66b2f93afb2108ada0617d26dceadb130b58a5d3070142a7f6aca4ade

      (For ppc64le architecture)
      The image digest is sha256:af37b07cf408da430bab837ba8a0083934fa99df14efd7855240b77d9e102f0e

      (For aarch64 architecture)
      The image digest is sha256:e5d7b0851e8cd4378bc810b2fd1f19489836ea186a6678eed1add4bed4f08b13

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.