GitHub Advisoryadvisory · PyPI

GHSA-836c-xg97-8p4h libtaxii Server-Side Request Forgery vulnerability

CRITICAL Published 2021-04-30 Modified 2024-09-27 Official page ↗
Aliases
CVE-2020-27197
Ecosystem
PyPI
Packages
libtaxii
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2021-04-20

Affected packages

• PyPI libtaxii: < 1.1.118 → fixed in 1.1.118

Description

"TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.""

Related

Alias · CVE (1)

  • CVE-2020-27197 TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http://… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References