CVE-2018-25282 Nmap 7.70 Denial of Service via XML Entity Expansion
MediumCVSS 6.9
EPSS 0.12%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/nmap(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) | All versions | No fix listed |
| ZenMap | = 7.70 | No fix listed |
References
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2461936 issue-tracking
- www.cve.org
- nvd.nist.gov
- Product Reference product
- ExploitDB-45357 exploit
- VulnCheck Advisory: Nmap 7.70 Denial of Service via XML Entity Expansion third-party-advisory