Описание
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | |
| esm-infra-legacy/trusty | released | 3.3.3-1ubuntu0.2+esm6 |
| esm-infra-legacy/xenial | released | 3.5.0-1ubuntu0.4+esm3 |
| esm-infra/bionic | released | 4.2.1-1ubuntu0.6+esm1 |
| esm-infra/focal | released | 4.5.0-1ubuntu0.5+esm1 |
| esm-infra/xenial | ignored | end of ESM support, was needs-triage |
| jammy | released | 4.8.0-1ubuntu0.1 |
| noble | released | 5.2.1-1ubuntu0.2 |
| questing | ignored | end of life, was needed |
| resolute | released | 6.0.2-1ubuntu0.1 |
Показывать по
EPSS
7.5 High
CVSS3
Связанные уязвимости
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
lxml is a library for processing XML and HTML in the Python language. ...
EPSS
7.5 High
CVSS3