GitHub Advisoryadvisory · PyPI
GHSA-m7m4-4vm8-55wg PyAMF vulnerable to XML external entity (XXE)
HIGH
Official page ↗
- Aliases
- CVE-2015-8549
- Ecosystem
- PyPI
- Packages
- pyamf
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- Weaknesses
- CWE-611
- Reviewed
- 2022-05-31
Affected packages
• PyPI pyamf: < 0.8.0 → fixed in 0.8.0
Description
PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
Related
Alias · CVE (1)
- CVE-2015-8549 XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files… vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8549 advisory
- https://github.com/hydralabs/pyamf/pull/58 web
- https://github.com/advisories/GHSA-m7m4-4vm8-55wg advisory
- https://github.com/hydralabs/pyamf package
- https://github.com/hydralabs/pyamf/releases/tag/v0.8.0 web
- https://github.com/pypa/advisory-database/tree/main/vulns/pyamf/PYSEC-2020-339.yaml web
- https://pypi.org/project/pyamf web
- http://www.ocert.org/advisories/ocert-2015-011.html web