PT-2023-11756 · Pyxml · Pyxml

Srikanthprathi · Published 2023-06-29 · Updated 2023-07-06 · CVE-2020-26709

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions py-xml version 1.0

Description The issue allows attackers to execute arbitrary code via a crafted XML file, exploiting an XML External Entity Injection (XXE) vulnerability.

Recommendations For py-xml version 1.0, consider disabling the XML parsing functionality until a patch is available to prevent exploitation of the XXE vulnerability.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-26709

GHSA-J6V2-MWXM-F952

PYSEC-2023-95

Affected Products

Pyxml

References · 8

• https://osv.dev/vulnerability/PYSEC-2023-95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26709 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26709 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6v2-mwxm-f952 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/py-xml/PYSEC-2023-95.yaml · Note
• https://github.com/PinaeOS/py-xml/issues/2 · Note
• https://github.com/PinaeOS/py-xml · Note
• https://t.me/cibsecurity/65764 · Telegram Post