CVE-2022-27193: XML External Entities Vulnerability in CVRF-CSAF-Converter
Summary
CVE-2022-27193: XML External Entities Vulnerability in CVRF-CSAF-Converter. Affects cvrf2csaf versions < 1.0.0rc2. Fixed in 1.0.0rc2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CVRF-CSAF-Converter is a Python package available on PyPI that converts Common Vulnerability Reporting Framework (CVRF) documents to Common Security Advisory Framework (CSAF) format. It is commonly used to transform vulnerability data into a standardized format for sharing and analysis. However, versions prior to 1.0.0-rc2 are vulnerable to XML External Entities (XXE) attacks. This means that an attacker can exploit the converter to include arbitrary local file content into the generated output document, potentially leading to the disclosure of sensitive information from the system running the converter.
Vulnerability Detail
The XML External Entities (XXE) vulnerability in CVRF-CSAF-Converter arises from the failure to properly handle external entities in XML parsing. By crafting a malicious CVRF document with specially crafted external entity references, an attacker can force the converter to access arbitrary files on the local system. This can result in the disclosure of sensitive information, such as configuration files, credentials, or other system-specific data. The impact of this vulnerability depends on the nature of the files that can be accessed and the privileges of the user running the converter.
How To Fix
Minimum fixed version
1.0.0rc2
This is the first release that contains the fix.
pip install --upgrade "cvrf2csaf==1.0.0rc2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable the processing of external entities in the XML parser used by CVRF-CSAF-Converter. This can be achieved by modifying the code to set the 'resolve_entities' option to False before parsing the XML document. Here is an example of how to implement this workaround in Python:
import xml.etree.ElementTree as ET
Disable external entity resolution
ET.parse(xml_file, parser=ET.XMLParser(resolve_entities=False))
Conclusion
CVRF-CSAF-Converter versions prior to 1.0.0-rc2 are vulnerable to an XML External Entities (XXE) vulnerability, which can be exploited to disclose sensitive information from the system running the converter. It is recommended to update to the latest version or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cvrf2csaf →
FAQ
CVRF-CSAF-Converter is a Python package that converts CVRF documents to CSAF format, facilitating the sharing and analysis of vulnerability data.
An XML External Entity (XXE) vulnerability occurs when an XML parser processes external entities, allowing an attacker to include arbitrary files and potentially disclose sensitive information.
The impact of this vulnerability depends on the files that can be accessed and the privileges of the user running the converter. It can lead to the disclosure of sensitive information stored on the local system.
To fix this vulnerability, update CVRF-CSAF-Converter to version 1.0.0-rc2 or later. Alternatively, you can implement the provided workaround to disable external entity resolution.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
