CVE-2020-5227: XML Denial of Service in feedgen
Summary
CVE-2020-5227: Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. Affects feedgen across 2 version ranges.
< 0.9.0
< f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf
Fixed in f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Feedgen is a Python library that allows the generation of RSS and Atom feeds. It provides functionality to create and manipulate XML content for various fields in the feed. However, versions prior to 0.9.0 are vulnerable to XML Denial of Service attacks. This means that if XML content from untrusted sources is directly included in the feed, it can lead to resource exhaustion and potential service disruption.
Vulnerability Detail
The vulnerability in feedgen arises from the parsing and integration of XML content into the existing XML tree. By including malicious XML, such as an XML Bomb, an attacker can cause the XML parser to consume excessive resources, leading to denial of service. This becomes a significant concern when feedgen is used to include content from untrusted sources and XML (including XHTML) is directly included instead of plain text content. The issue has been addressed in feedgen 0.9.0, which disallows XML entity expansion and external resources.
How To Fix
Minimum fixed version
f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf
This is the first release that contains the fix.
pip install --upgrade "feedgen==f57a01b20fa4aaaeccfa417f28e66b4084b9d0cf"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in feedgen (CVE-2020-5227) allows for XML Denial of Service attacks, potentially leading to service disruption. It is crucial to update feedgen to version 0.9.0 or later to mitigate this risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for feedgen →
FAQ
Feedgen is a Python library used for generating RSS and Atom feeds.
XML Denial of Service is a type of attack where an attacker sends malicious XML content that causes the XML parser to consume excessive resources, leading to service disruption.
If an application uses feedgen to include XML content from untrusted sources, and if XML (including XHTML) is directly included instead of plain text content, it can be vulnerable to XML Denial of Service attacks. This can result in resource exhaustion and potential service disruption.
Yes, the vulnerability has been fixed in feedgen version 0.9.0. It disallows XML entity expansion and external resources, mitigating the risk of XML Denial of Service attacks.
You can update feedgen to the fixed version (0.9.0) by running the command 'pip install --upgrade feedgen'.
