Libexpat before 2.4.5 contains a CVE

[esnible]

The "Mend" tool complains about a CVE in the embedded version of Expat. Consider replacing the current Expat source with newer version.

• https://www.mend.io/vulnerability-database/CVE-2022-25235
  • Critical severity

The claim is that

• xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Here is Expat's fix of the issue

• libexpat/libexpat@3f0a0cb

Go-graphviz is using this version

• https://github.com/goccy/go-graphviz/blob/master/internal/expat/xmltok_impl.c

Related: #42 (comment)

[Alex-Tsekhansky-IBM]

I'd like to add that the scanner noted the vulnerability in the code used by our group as well (and I assume Ed's issue came up from the same scanner) with the following suggested fix:

Upgrade to version: cmake - 3.19.5,3.17.3,3.22.0;cmake-native - 3.22.0,3.17.3,3.20.1;python3 - 3.8.2. So at least part of the issue may simply be related to a build rather than the code.

Is it possible to rerun the build using the minimum component version indicated, by any chance?