PT-2020-18323 · Python · Feedgen

Lkiesow · Published 2020-01-28 · Updated 2020-02-08 · CVE-2020-5227

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions python feedgen versions prior to 0.9.0

Description The feedgen library is susceptible to XML Denial of Service attacks when supplying XML as content for some fields, which can be parsed and integrated into the existing XML tree. This becomes a concern if feedgen is used to include content from untrusted sources and if XML is directly included instead of providing plain text content only.

Recommendations For versions prior to 0.9.0, update to feedgen 0.9.0, which disallows XML entity expansion and external resources. As a temporary workaround, avoid providing XML directly to feedgen or ensure that no entity expansion is part of the XML.

Exploit

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2020-5227

GHSA-G8Q7-XV52-HF9F

PYSEC-2020-231

Affected Products

Feedgen

References · 12

• 🔥 https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses · Exploit
• https://github.com/lkiesow/python-feedgen/commit/f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6I5ENUYGFNMIH6ZQ62FZ6VU2WD3SIOI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T6I5ENUYGFNMIH6ZQ62FZ6VU2WD3SIOI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5227 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5227 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g8q7-xv52-hf9f · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-231 · Vendor Advisory
• https://github.com/lkiesow/python-feedgen/security/advisories/GHSA-g8q7-xv52-hf9f · Note
• https://github.com/lkiesow/python-feedgen · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/feedgen/PYSEC-2020-231.yaml · Note
• https://t.me/cvenotify/579 · Telegram Post