Alpine: multiple expat packages, libexpat: security update to 2.4.2-r0 (deprecated)

critical Tenable Self-Hosted Container Security Plugin ID 400031

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in
xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
(CVE-2021-45960)

- A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�)
vulnerability exists that could allow an attacker to impersonate the user who manages the charging station
or carry out actions on their behalf when crafted malicious parameters are submitted to the charging
station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2
), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A
(All versions prior to R8 V3.4.0.2) (CVE-2021-22822)

- A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of
arbitrary files in the context of the user running IGSS due to lack of validation of network messages.
Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior)
(CVE-2021-22823)

- A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of
service, due to missing length check on user-supplied data from a constructed message received on the
network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and
prior) (CVE-2021-22824)

- A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could
allow an attacker to access the system with elevated privileges when a privileged account clicks on a
malicious URL that compromises the security token. Affected Products: AP7xxxx and AP8xxx with NMC2 (V6.9.6
or earlier), AP7xxx and AP8xxx with NMC3 (V1.1.0.3 or earlier), and APDU9xxx with NMC3 (V1.0.0.28 or
earlier) (CVE-2021-22825)

Plugin Details

Severity: Critical

ID: 400031

Version: Revision 1.31

Type: Local

Family: Alpine Linux Local Security Checks

Published: 1/31/2022

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2021-45960

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2021-22823

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/16/2022

Vulnerability Publication Date: 1/1/2022

Reference Information

CVE: CVE-2021-22822, CVE-2021-22823, CVE-2021-22824, CVE-2021-22825, CVE-2021-22826, CVE-2021-22827, CVE-2021-45960, CVE-2021-46143

Detections

Analytics