CVE-2012-2921: Universal Feed Parser Denial of Service Vulnerability
Summary
CVE-2012-2921: Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document. Affects feedparser versions < 5.1.2. Fixed in 5.1.2. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2012-2921 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Universal Feed Parser (also known as feedparser or python-feedparser) is a Python library that provides functionality for parsing and processing various types of syndication feeds, including RSS and Atom. It is widely used in applications that require feed aggregation and content extraction. However, versions prior to 5.1.2 are vulnerable to a denial of service (DoS) attack caused by a crafted XML ENTITY declaration in a non-ASCII encoded document.
Vulnerability Detail
The vulnerability in Universal Feed Parser allows remote attackers to consume excessive memory, leading to a denial of service condition. By exploiting a flaw in the parsing of XML ENTITY declarations, an attacker can craft a malicious feed with specially crafted non-ASCII encoded content. When this feed is processed by an application using the vulnerable version of Universal Feed Parser, it can cause the application to consume an excessive amount of memory, eventually leading to a crash or system instability. This vulnerability poses a risk to applications that parse untrusted or user-supplied feeds.
How To Fix
Minimum fixed version
5.1.2
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Universal Feed Parser library prior to version 5.1.2 is vulnerable to a denial of service attack caused by a crafted XML ENTITY declaration. Upgrading to version 5.1.2 or later is recommended to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser is a Python library used for parsing and processing syndication feeds like RSS and Atom.
The vulnerability allows remote attackers to cause a denial of service by consuming excessive memory.
To protect your application, it is recommended to upgrade to the fixed version of Universal Feed Parser (5.1.2 or later).
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version.
Yes, proof-of-concept code may be available, but it is not provided in this report. It is advised to follow responsible disclosure practices and obtain the code from trusted sources.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
