GHSA-m8gq-83gh-v42v

XML External Entities Vulnerability in CVRF-CSAF-Converter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-27193

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cvrf2csaf	< 1.0.0rc2	1.0.0rc2

Details

As written in the advisory (Markdown source, shown as plain text).

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-27193 advisory
https://github.com/csaf-tools/CVRF-CSAF-Converter package
https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2 web