Denial of Service Vulnerability in Universal Feed Parser
Summary
CVE-2012-2921: Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document. Affects feedparser versions < 5.1.2-1. Fixed in 5.1.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Universal Feed Parser (also known as feedparser or python-feedparser) is a Python library used for parsing RSS and Atom feeds. It provides a convenient way to extract data from feed documents and is widely used in various applications. However, versions prior to 5.1.2 are vulnerable to a denial of service attack.
Vulnerability Detail
The vulnerability, identified as CVE-2012-2921, allows remote attackers to cause a denial of service by exploiting a memory consumption issue. By sending a crafted XML ENTITY declaration in a non-ASCII encoded document, an attacker can cause the parser to consume excessive memory, leading to resource exhaustion and potential system instability.
How To Fix
Minimum fixed version
5.1.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade feedparserTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the library to the fixed version to mitigate the risk of a denial of service attack.
Conclusion
The denial of service vulnerability in Universal Feed Parser can be mitigated by updating the library to version 5.1.2-1 or later. It is crucial to apply this fix to prevent potential resource exhaustion and system instability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser is a Python library used for parsing RSS and Atom feeds. It allows developers to extract data from feed documents easily.
The vulnerability can be exploited by remote attackers to cause a denial of service, leading to excessive memory consumption and potential system instability.
To fix this vulnerability, update the Universal Feed Parser library to version 5.1.2-1 or later.
No, there is no known workaround for this vulnerability. Updating the library to the fixed version is the recommended solution.
You can find more information about this vulnerability in the CVE-2012-2921 JSON report: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2012-2921.json
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
