XXE in Feedgen Project
CVE-2020-5227
Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.022 (81.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000
Affected products
- Feedgen Project
- Lkiesow Python-Feedgen — versions < 0.9.0
Weakness classification (CWE)
References
- github.com/lkiesow/python-feedgen/security/advisories/GHSA-g8q7-xv52-hf9f (Third Party Advisory)
- docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-serv… (Exploit, Patch, Third Party Advisory, Vendor Advisory)
- github.com/lkiesow/python-feedgen/commit/f57a01b20fa4aaaeccfa417f28e66b4084b9d0… (Patch)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2020-5227?
- CVE-2020-5227 is a medium-severity vulnerability in Feedgen Project, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 4.4/10. Published 2020-01-28.
- How severe is CVE-2020-5227?
- Medium severity. CVSS v3 base score is 4.4 out of 10.