Oracle Linux 7 : xmlsec1 (ELSA-2017-2492)

Medium Nessus Plugin ID 102633


The remote Oracle Linux host is missing one or more security updates.


From Red Hat Security Advisory 2017:2492 :

An update for xmlsec1 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards 'XML Digital Signature' and 'XML Encryption'.

Security Fix(es) :

* It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion (XXE) along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service. (CVE-2017-1000061)


Update the affected xmlsec1 packages.

See Also

Plugin Details

Severity: Medium

ID: 102633

File Name: oraclelinux_ELSA-2017-2492.nasl

Version: $Revision: 3.3 $

Type: local

Agent: unix

Published: 2017/08/22

Modified: 2018/02/01

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5.8

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:U/RC:ND


Base Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:xmlsec1, p-cpe:/a:oracle:linux:xmlsec1-devel, p-cpe:/a:oracle:linux:xmlsec1-gcrypt, p-cpe:/a:oracle:linux:xmlsec1-gcrypt-devel, p-cpe:/a:oracle:linux:xmlsec1-gnutls, p-cpe:/a:oracle:linux:xmlsec1-gnutls-devel, p-cpe:/a:oracle:linux:xmlsec1-nss, p-cpe:/a:oracle:linux:xmlsec1-nss-devel, p-cpe:/a:oracle:linux:xmlsec1-openssl, p-cpe:/a:oracle:linux:xmlsec1-openssl-devel, cpe:/o:oracle:linux:7

Required KB Items: Host/local_checks_enabled, Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/08/21

Reference Information

CVE: CVE-2017-1000061

OSVDB: 147409

RHSA: 2017:2492