PT-2021-6838 · Glance+3 · Glance+3

Unknown · Published 2021-07-29 · Updated 2022-07-25 · CVE-2021-23418

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions glances versions prior to 3.2.1

Description The issue is related to the incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to gain access to confidential data, disrupt its integrity, and cause a denial of service. The vulnerability is due to the use of Fault to parse untrusted XML data, making it susceptible to XML External Entity (XXE) Injection attacks.

Recommendations For glances versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Fault component to parse untrusted XML data until a patch is available. Avoid using the Fault function to parse untrusted XML data in the affected API endpoints until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2021-2545

ALT-PU-2021-3612

ALT-PU-2022-2255

BDU:2022-02263

CVE-2021-23418

GHSA-R2MJ-8WGQ-73M6

PYSEC-2021-115

SNYK-PYTHON-GLANCES-1311807

USN-5187-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Glance

References · 24

• 🔥 https://github.com/nicolargo/glances/issues/1025 · Exploit
• https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94 · Patch
• https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32 · Patch
• https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a · Patch
• https://bdu.fstec.ru/vul/2022-02263 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23418 · Vendor Advisory
• https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23418 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5187-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2mj-8wgq-73m6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23418 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5187-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23418 · Security Note
• https://ubuntu.com/security/CVE-2021-23418 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23418 · Security Note