PT-2022-28213 · Python · Xml.Etree.Elementtree

Published 2022-08-11 · Updated 2022-08-11

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mofh versions prior to 1.0.1

Description The issue affects the xml.etree.ElementTree module, making the application susceptible to denial-of-service attacks, specifically the Billion Laughs attack and the Quadratic blowup attack. These attacks exploit entity expansion, overwhelming the parser with multiple levels of nested entities or repeated large entities.

Recommendations For versions prior to 1.0.1, upgrade to version 1.0.1 or later, which utilizes the defusedxml package to patch the issue. As a temporary workaround, consider calling defusedxml.defuse stdlib() before making any requests using the client. Restrict the use of custom API URLs or ensure MyOwnFreeHost's API is secure to minimize the risk of exploitation.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

GHSA-7R9X-QRPR-3CXW

Affected Products

Xml.Etree.Elementtree

References · 5

• https://osv.dev/vulnerability/GHSA-7r9x-qrpr-3cxw · Vendor Advisory
• https://github.com/Wallvon/mofh · Note
• https://github.com/Wallvon/mofh/commit/da0d33cfd368e2f237ab28bf7a7f00e3d281005a · Note
• https://github.com/Wallvon/mofh/security/advisories/GHSA-7r9x-qrpr-3cxw · Note
• https://acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack · Note