XXE in Feedgen Project
CVE-2020-5227
Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.
EPSS: 0.022 (80.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Feedgen_project Feedgen
- Lkiesow Python-feedgen — versions < 0.9.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Exploit, Patch, Third Party Advisory, x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2020-5227?
- CVE-2020-5227 is a medium-severity vulnerability in Feedgen Project, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 4.4/10. Published 2020-01-28.
- How severe is CVE-2020-5227?
- Medium severity. CVSS v3 base score is 4.4 out of 10.