CVE-2011-1156: Denial of Service in Universal Feed Parser
Summary
CVE-2011-1156: feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration. Affects feedparser versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2011-1156 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Universal Feed Parser (aka feedparser or python-feedparser) is a Python library that provides functionality for parsing and processing various types of syndication feeds, including RSS and Atom. It is widely used in Python applications to handle feed data and extract relevant information.
Vulnerability Detail
The vulnerability identified as CVE-2011-1156 affects versions of Universal Feed Parser prior to 5.0.1. It allows remote attackers to cause a denial of service (application crash) by exploiting a malformed DOCTYPE declaration. This vulnerability can be triggered when parsing a feed that contains a specially crafted DOCTYPE declaration. The malformed declaration causes the application to crash, resulting in a denial of service condition. The impact of this vulnerability is limited to a crash and does not lead to remote code execution or data compromise.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Universal Feed Parser (CVE-2011-1156) allows remote attackers to cause a denial of service by exploiting a malformed DOCTYPE declaration. To mitigate this vulnerability, it is crucial to update the Universal Feed Parser library to version 5.0.1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser is a Python library used for parsing and processing syndication feeds like RSS and Atom.
The vulnerability allows remote attackers to cause a denial of service by exploiting a malformed DOCTYPE declaration, resulting in an application crash.
To fix this vulnerability, update the Universal Feed Parser library to version 5.0.1 or later using the 'pip install --upgrade feedparser' command.
No, this vulnerability only causes a denial of service (application crash) and does not lead to remote code execution or data compromise.
No, the recommended fix is to update the Universal Feed Parser library to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
