Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] CVE-2022-49043 xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. #9453

Open
maxlepikhin opened this issue Feb 26, 2025 · 0 comments
Labels
bug Something isn't working cve Security vulnerabilities detected by Dependabot or Mend untriaged

Comments

@maxlepikhin
Copy link

Describe the bug
Trivy security scanning flagged libxml2 due to this CVE:
CVE-2022-49043

To Reproduce

docker run -it --entrypoint=/bin/bash opensearchproject/opensearch-dashboards:2.19.0
ls /usr/lib64 | grep libxml

observe the output:

libxml2.so.2
libxml2.so.2.10.4

Expected behavior
Trivy does not flag libxml2 library.

OpenSearch Version
2.19.0

Dashboards Version
2.19.0

Plugins
N/A

Screenshots
N/A

Host/Environment (please complete the following information):
Ubuntu 24.04

Additional context
N/A

@maxlepikhin maxlepikhin added bug Something isn't working untriaged labels Feb 26, 2025
@kavilla kavilla added the cve Security vulnerabilities detected by Dependabot or Mend label Mar 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working cve Security vulnerabilities detected by Dependabot or Mend untriaged
Projects
None yet
Development

No branches or pull requests

2 participants