PT-2021-16877 · Xml2Dict · Xml2Dict

Published 2021-06-30 · Updated 2021-07-06 · CVE-2021-25951

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XML2Dict version 0.2.2

Description The issue is an XXE vulnerability that allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references.

Recommendations For XML2Dict version 0.2.2, consider disabling the parse function until a patch is available to prevent potential denial of service attacks. Restrict access to the XML2Dict module to minimize the risk of exploitation.

Exploit

Fix

XXE

XML Entity Expansion

Weakness Enumeration

CWE-611

CWE-776

Related Identifiers

CVE-2021-25951

GHSA-GP6M-VQHM-5CM5

PYSEC-2021-349

Affected Products

Xml2Dict

References · 12

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25951 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25951 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25951 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gp6m-vqhm-5cm5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-349 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/xml2dict/PYSEC-2021-349.yaml · Note
• https://github.com/mcspring/xml2dict · Note
• https://github.com/mcspring/XML2Dict/tree/master · Note
• https://t.me/cvenotify/17147 · Telegram Post
• https://github.com/advisories/GHSA-gp6m-vqhm-5cm5 · Note
• https://t.me/cvenotify/16907 · Telegram Post
• https://pypi.org/project/XML2Dict · Note