GHSA-r2mj-8wgq-73m6

XML External Entity Reference in Glances

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23418

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Glances	< 3.2.1	3.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23418 advisory
https://github.com/nicolargo/glances/issues/1025 web
https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94 web
https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a web
https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32 web
https://github.com/advisories/GHSA-r2mj-8wgq-73m6 advisory
https://github.com/nicolargo/glances package
https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2021-115.yaml web
https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807 web