CVE-2024-50602

Description

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

How to fix CVE-2024-50602

To remediate CVE-2024-50602, upgrade the affected package to a fixed version below.

• Alpine/expat—upgrade to 2.6.4-r0 or later
• Bitnami/libpython—upgrade to 3.9.21 or later
• —upgrade to 3.9.21 or later
• —upgrade to 3.9.21 or later
• —upgrade to 2.2.10-2+deb11u7 or later
• —upgrade to 2.2.10-2+deb11u7 or later
• —no fix listed

Is CVE-2024-50602 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 2.6.4-r0
• from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.11, >= 3.12.0, < 3.12.8, >= 3.13.0, < 3.13.1
• from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.11, >= 3.12.0, < 3.12.8, >= 3.13.0, < 3.13.1
• from 0, < 3.9.21, >= 3.10.0, < 3.10.16, >= 3.11.0, < 3.11.11, >= 3.12.0, < 3.12.8, >= 3.13.0, < 3.13.1
• from 0, < 2.2.10-2+deb11u7
• from 0, < 2.2.10-2+deb11u7
• from 0

CVSS scores

References (12)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2024-50602
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-50602
• WEBdocs.python.org/release/3.10.16/whatsnew/changelog.html
• WEBdocs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11