CVE-2020-5227: Feedgen Vulnerable to XML Denial of Service Attacks
Summary
CVE-2020-5227: Feedgen Vulnerable to XML Denial of Service Attacks. Affects feedgen versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The feedgen library is an open-source Python package available on PyPI. It provides functionality for generating RSS and Atom feeds. The library allows users to supply XML content for certain fields, which is then parsed and integrated into the existing XML tree. However, this XML parsing process makes feedgen susceptible to XML Denial of Service Attacks, such as XML Bombs. This vulnerability becomes a concern when feedgen is used to include content from untrusted sources and when XML (including XHTML) is directly included instead of plain text content.
Vulnerability Detail
The vulnerability in feedgen arises from its lack of protection against XML Denial of Service Attacks. An attacker can exploit this vulnerability by providing malicious XML content that triggers excessive resource consumption during parsing, leading to a denial of service condition. This can result in the unavailability of the affected feedgen instance and potentially impact the availability of other services or systems that rely on it. The vulnerability has a CVSS score of 4.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.9.0
This is the first release that contains the fix.
pip install --upgrade "feedgen==0.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating feedgen is not immediately feasible, it is recommended to avoid providing XML directly to feedgen. Alternatively, if XML content must be included, ensure that no entity expansion is part of the XML. This can be achieved by sanitizing and validating the XML content before passing it to feedgen.
Conclusion
The feedgen library is vulnerable to XML Denial of Service Attacks, which can result in a denial of service condition. It is crucial to update feedgen to version 0.9.0 or later to mitigate this vulnerability. As a temporary workaround, avoid providing XML directly to feedgen or ensure that the XML does not contain entity expansion. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for feedgen →
FAQ
Feedgen is a Python library available on PyPI that enables the generation of RSS and Atom feeds.
An XML Denial of Service Attack is a type of attack that exploits vulnerabilities in XML parsers, causing excessive resource consumption and leading to a denial of service condition.
An XML Bomb is a specific type of XML Denial of Service Attack that utilizes recursive entity expansion to create an exponentially expanding XML document, overwhelming the parser and consuming excessive resources.
To update feedgen, you can use the following command: pip install --upgrade feedgen
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to address the issue promptly to prevent potential attacks.
