GitHub Advisoryadvisory · PyPI

GHSA-9ccv-p7fg-m73x XML Injection in python-libnmap

HIGH Published 2019-07-18 Modified 2024-10-15 Official page ↗
Aliases
CVE-2019-1010017
Ecosystem
PyPI
Packages
python-libnmap
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-91
Reviewed
2019-07-18

Affected packages

• PyPI python-libnmap: < 0.7.2 → fixed in 0.7.2

Description

Description python-libnmap is affected by a Billion-Laughs -style XML injection vulnerability. PoC ```python ty = NmapParser() payload = """ ]> &lol3; """ ty.parse(payload) ```

Related

Alias · CVE (1)

  • CVE-2019-1010017 libnmap < v0.6.3 is affected by: XML Injection. vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References