{"schemaVersion":3,"id":"CVE-2022-2309","aliases":["ALPINE-CVE-2022-2309","MGASA-2022-0331","SUSE-SU-2022:2878-1","SUSE-SU-2022:2908-1","GHSA-wrxv-2j5q-m38w","PYSEC-2022-230","RHSA-2022:8226","UBUNTU-CVE-2022-2309","DEBIAN-CVE-2022-2309","openSUSE-SU-2024:12290-1"],"status":"published","duplicateOf":null,"title":null,"description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","dates":{"published":"2022-07-05T09:00:12.000Z","modified":"2025-11-04T16:09:31.952Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Pypi","score":6.9,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Pypi","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02448,"percentile":0.84147,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.17800000000000005,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02626},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02448,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02448,"percentile":0.84147}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02626,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02703,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02428,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02448,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02448,"percentile":0.84147}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_1A5B1B0DBF55590A","name":"Exploit Reference (huntr.dev)","source":"reference","url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-476","name":"NULL Pointer Dereference","description":"The product dereferences a pointer that it expects to be valid but is NULL.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/476.html"}],"affected":[{"vendor":"alpine","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/libxml2","purlType":"apk","versions":[{"text":"< 2.9.14-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.10.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.14-r1 | < 2.10.0-r0","eol":null,"hubHref":null},{"vendor":"alpine","product":"py3-lxml","name":"py3-lxml","label":"py3-lxml","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/py3-lxml","purlType":"apk","versions":[{"text":"< 4.9.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.2-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libxml2","purlType":"deb","versions":[{"text":"< 2.9.14+dfsg-1.3~deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.14+dfsg-1.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.14+dfsg-1.3~deb12u1 | < 2.9.14+dfsg-1.3","eol":null,"hubHref":null},{"vendor":"debian","product":"lxml","name":"lxml","label":"lxml","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/lxml","purlType":"deb","versions":[{"text":"< 4.9.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libxml2","purlType":"deb","versions":[{"text":"< 2.9.10+dfsg-5ubuntu0.20.04.5","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.13+dfsg-1ubuntu0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.10+dfsg-5ubuntu0.20.04.5 | < 2.9.13+dfsg-1ubuntu0.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"lxml","name":"lxml","label":"lxml","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/lxml","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"36","noFixRecorded":false,"fixedIn":null},{"text":"37","noFixRecorded":false,"fixedIn":null}],"versionsText":"36 | 37","eol":{"isEol":true,"eolDate":"2023-05-16T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"36","label":"36","eolFrom":"2023-05-16T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"lxml","product":"lxml","name":"lxml","label":"lxml","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.1","eol":null,"hubHref":"/vendor/lxml/lxml"},{"vendor":"lxml","product":"lxml/lxml","name":"lxml/lxml","label":"lxml/lxml","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 4.9.1","eol":null,"hubHref":"/vendor/lxml/lxmllxml"},{"vendor":"mageia","product":"python-lxml","name":"python-lxml","label":"python-lxml","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/python-lxml","purlType":"rpm","versions":[{"text":"< 4.9.1-1.mga8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.9.1-1.mga8","eol":null,"hubHref":null},{"vendor":"PyPI","product":"lxml","name":"lxml","label":"lxml","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/lxml","purlType":"pypi","versions":[{"text":"< 86368e9cf70a0ad23cccd5ee32de847149af0c6f","noFixRecorded":false,"fixedIn":null},{"text":"< 4.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 86368e9cf70a0ad23cccd5ee32de847149af0c6f | < 4.9.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"libxml2&distro=openSUSE Tumbleweed","name":"libxml2","label":"libxml2&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/libxml2&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 2.10.1-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.10.1-1.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"python-lxml&distro=openSUSE Leap 15.3","name":"python-lxml","label":"python-lxml&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/python-lxml&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"python-lxml&distro=openSUSE Leap 15.4","name":"python-lxml","label":"python-lxml&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/python-lxml&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"redhat","product":"python-lxml","name":"python-lxml","label":"python-lxml","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/python-lxml","purlType":"rpm","versions":[{"text":"< 0:4.6.5-3.el9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:4.6.5-3.el9","eol":null,"hubHref":null},{"vendor":"redhat","product":"python-lxml-debugsource","name":"python-lxml-debugsource","label":"python-lxml-debugsource","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/python-lxml-debugsource","purlType":"rpm","versions":[{"text":"< 0:4.6.5-3.el9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:4.6.5-3.el9","eol":null,"hubHref":null},{"vendor":"redhat","product":"python3-lxml","name":"python3-lxml","label":"python3-lxml","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/python3-lxml","purlType":"rpm","versions":[{"text":"< 0:4.6.5-3.el9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:4.6.5-3.el9","eol":null,"hubHref":null},{"vendor":"redhat","product":"python3-lxml-debuginfo","name":"python3-lxml-debuginfo","label":"python3-lxml-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/python3-lxml-debuginfo","purlType":"rpm","versions":[{"text":"< 0:4.6.5-3.el9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:4.6.5-3.el9","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Enterprise Storage 7","name":"python-lxml","label":"python-lxml&distro=SUSE Enterprise Storage 7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Enterprise Storage 7","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Module for Public Cloud 15","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Module for Public Cloud 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Module for Public Cloud 15","purlType":"rpm","versions":[{"text":"< 4.7.1-150100.6.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150100.6.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Module for Python 2 15 SP3","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Module for Python 2 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Module for Python 2 15 SP3","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-BCL","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-BCL","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Server 15 SP2-LTSS","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","name":"python-lxml","label":"python-lxml&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Manager Proxy 4.1","name":"python-lxml","label":"python-lxml&distro=SUSE Manager Proxy 4.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Manager Proxy 4.1","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Manager Retail Branch Server 4.1","name":"python-lxml","label":"python-lxml&distro=SUSE Manager Retail Branch Server 4.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Manager Retail Branch Server 4.1","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"python-lxml&distro=SUSE Manager Server 4.1","name":"python-lxml","label":"python-lxml&distro=SUSE Manager Server 4.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/python-lxml&distro=SUSE Manager Server 4.1","purlType":"rpm","versions":[{"text":"< 4.7.1-150200.3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.7.1-150200.3.10.1","eol":null,"hubHref":null}],"affectedCount":31,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","label":"huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","hostname":"huntr.dev","tags":["X Refsource CONFIRM","WEB","REPORT","Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","label":"github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","REPORT","Patch","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202208-06","label":"security.gentoo.org/glsa/202208-06","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","WEB","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0006/","label":"security.netapp.com/advisory/ntap-20220915-0006/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html","label":"lists.debian.org/debian-lts-announce/2024/09/msg00021.html","hostname":"lists.debian.org","tags":["WEB"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-2309","label":"security.alpinelinux.org/vuln/CVE-2022-2309","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0331.html","label":"advisories.mageia.org/MGASA-2022-0331.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30772","label":"bugs.mageia.org/show_bug.cgi?id=30772","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-August/011973.html","label":"lists.suse.com/pipermail/sle-security-updates/2022-August/011973.html","hostname":"lists.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222878-1/","label":"www.suse.com/support/update/announcement/2022/suse-su-20222878-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1201253","label":"bugzilla.suse.com/1201253","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2309","label":"www.suse.com/security/cve/CVE-2022-2309","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222908-1/","label":"www.suse.com/support/update/announcement/2022/suse-su-20222908-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309","label":"nvd.nist.gov/vuln/detail/CVE-2022-2309","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w","label":"github.com/advisories/GHSA-wrxv-2j5q-m38w","hostname":"github.com","tags":["Advisory"]},{"url":"https://github.com/lxml/lxml","label":"github.com/lxml/lxml","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/lxml/lxml/blob/master/CHANGES.txt","label":"github.com/lxml/lxml/blob/master/CHANGES.txt","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0006","label":"security.netapp.com/advisory/ntap-20220915-0006","hostname":"security.netapp.com","tags":["WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8226","label":"access.redhat.com/errata/RHSA-2022:8226","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","label":"access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107571","label":"bugzilla.redhat.com/show_bug.cgi?id=2107571","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8226.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8226.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2309","label":"access.redhat.com/security/cve/CVE-2022-2309","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2309","label":"www.cve.org/CVERecord?id=CVE-2022-2309","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://ubuntu.com/security/CVE-2022-2309","label":"ubuntu.com/security/CVE-2022-2309","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba/","label":"huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba/","hostname":"huntr.dev","tags":["REPORT"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/378","label":"gitlab.gnome.org/GNOME/libxml2/-/issues/378","hostname":"gitlab.gnome.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5760-1","label":"ubuntu.com/security/notices/USN-5760-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6028-2","label":"ubuntu.com/security/notices/USN-6028-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2309","label":"security-tracker.debian.org/tracker/CVE-2022-2309","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-3878-1","MGASA-2023-0157","USN-5760-1"],"duplicates":[],"related":["USN-5760-1"]},"timeline":[{"kind":"published","date":"2022-07-05T09:00:12.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-04T16:09:31.952Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:45:28.172Z","stale":false,"partial":false}}