Out-of-Bounds Read in libxml2
CVE: CVE-2025-32414
Component: libxml2
CWE: CWE-393
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2025-04-08T00:00:00+00:00

A flaw was found in libxml2. This vulnerability allows out-of-bounds memory access due to incorrect handling of return values in xmlPythonFileRead and xmlPythonFileReadRaw. This is caused by a mismatch between the length of the file in bytes vs the length in characters, as unicode characters can occupy up to 4 bytes per character.

Statement: This bug affects parsing of text streams using:
- the Python bindings (pending deprecation: https://gitlab.gnome.org/GNOME/libxml2/-/issues/891)
- the libxml2 SAX driver drv_libxml2,
- the XML Reader API

Parsing of binary streams is not affected by this vulnerability.

The vulnerability exists in the libxml2 package the bug arises because of a mismatch between characters vs. bytes handling: functions xmlPythonFileRead and xmlPythonFileReadRaw may compute a length incorrectly (mistaking character count for byte count), but for a successful exploitation of this bug requires local access, on top of that the path to exploitation is non trivial, where handling of python binding's and specific input handling of bytes and characters are required which makes this outside the scope of an attacker and increases the attack complexity, for these reasons this has been marked as moderate by Red Hat.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous erratamupdate:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7c5f757b5d3d2048052401dd057f3096890b4075ca9b86b5f890a8e4c6d38b85

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:32f55a5ff24713e240a293ced4f8cb202bbdf482095593e226d1ea4397fefe8e

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5f0204b0de50a408dc8b52f568e90aef6b3266ee8d22a77c1b34ceefb2b00f14

      (For s390x architecture)
      The image digest is sha256:758be0c12f06fadff01eb06d514ed48c306679706b3a82b72a2943f211003a7b

      (For ppc64le architecture)
      The image digest is sha256:9d022cdb3929572745d9b77d9f27e29fcc8ff5c7c5d04b404e81600601e7d6c7

      (For aarch64 architecture)
      The image digest is sha256:c75cf7a5560e7352860dcf9ae8f115a7ce7b45ca05744d65af7513ce4913ea7d

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:427fc0b133cc2aa45a68c36b603403ab278c845c0232e1c59387c4abfff01b9a

      (For s390x architecture)
      The image digest is sha256:ba89251bdd0f31c6a05306c3696dcaf38072eacf0b8ad8bfd7d8048b4038ccca

      (For ppc64le architecture)
      The image digest is sha256:9b60e5392e2733aab78a7a89f6735620ad229e415737c16b930efe59fe0810dd

      (For aarch64 architecture)
      The image digest is sha256:3843de0e1511bbe78f5045f6b7bcfbdc3f0836c9d07d5ec320033c8105a09890

All OpenShift Container Platform 4.15 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:b2d8af25d1a0440fce3e16a7d5481a228c29bdf7510f9c2bbef241e495004992

      (For s390x architecture)
      The image digest is sha256:b8fa63beeecb258529d2b8b22fdd90ef4846691c8e41aaff2d02279d72563a25

      (For ppc64le architecture)
      The image digest is sha256:6847316b4a13f663f32227107ae23f31a223dcc3b7d1718da837b8a539e97212

      (For aarch64 architecture)
      The image digest is sha256:6a66ef4370c883267c500672f7c9b53293a431049fd0ec2496c9ab5ecdcc0ce5

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:fea49ae633643615f8707ecbe801b484181b87db0746d2d85592768dbddf43c9

      (For s390x architecture)
      The image digest is sha256:d3e9032b799e87cc82121c9da006d375845134120205fa2aa2edca033abf97d3

      (For ppc64le architecture)
      The image digest is sha256:6c6251666a8e89289819cdb9dd7269d1ab2d90fdcb96c2b15b2e04908d15fd88

      (For aarch64 architecture)
      The image digest is sha256:3b83546dc680f6e3975faf101471c4e29fdc76f406327665e22f63ff406246c0

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata or x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:0bf2e8c1edf16de717c330b94d85f6d463c7208956b0a545cbb3fcf715e14c38

      (For s390x architecture)
      The image digest is sha256:893ccb2c14b7d7051cbe36098fd1f5655685e4798e0e5dfef7848ed40c8defde

      (For ppc64le architecture)
      The image digest is sha256:0833db4c468d81168bb43c46ad0f1af1cf7966b39fa3e2b519725cf96a784c3a

      (For aarch64 architecture)
      The image digest is sha256:aac369ac9c41f62395ec14d2ea7d8a577a5dcc796c5f2bdf0c615ff58bbeb76b

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:2f9145136fb387d43c7fff55b30a036c14eb96b0992c292274b6f543c6c33857

      (For s390x architecture)
      The image digest is sha256:a7abeba0f7c9f810ae85ce6cd7d12e926af6143f9236e3c09eec54f71504c999

      (For ppc64le architecture)
      The image digest is sha256:890b7b27500f0efaa9c10f45c59303d119fbe70a0d29762d45a279bd65e86745

      (For aarch64 architecture)
      The image digest is sha256:4d3205f720af3af84c842db70ce08f16c4f98a86ea63c57aa85fe5dc12c6d672

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The Insights proxy container image provided here is downloaded by the Red Hat Insights proxy product RPM.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.