CVE-2009-5065: Cross-site Scripting Vulnerability in feedparser
Summary
CVE-2009-5065: feedparser Cross-site Scripting vulnerability. Affects feedparser versions < 5.0. Fixed in 5.0. How to fix ↓
Also tracked for
- feedparser · Debian:11
The same CVE-2009-5065 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is Universal Feed Parser (feedparser), which is a Python library used for parsing RSS and Atom feeds. It provides a convenient way to extract and process data from various feed formats. The vulnerability in question is an instance of cross-site scripting (XSS) that exists in feedparser.py. This vulnerability allows remote attackers to inject arbitrary web script or HTML by exploiting nested CDATA stanzas.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in feedparser.py allows attackers to inject malicious web script or HTML into the generated web pages. This can lead to various security issues, such as session hijacking, defacement of web pages, or theft of sensitive information. The vulnerability arises from improper neutralization of user-controlled input during web page generation. By exploiting nested CDATA stanzas, attackers can bypass input sanitization and inject their own code into the output.
How To Fix
Minimum fixed version
5.0
This is the first release that contains the fix.
pip install --upgrade "feedparser==5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Universal Feed Parser to mitigate the risk of exploitation.
Conclusion
The cross-site scripting vulnerability in feedparser.py poses a security risk to applications utilizing Universal Feed Parser. To mitigate this risk, it is crucial to upgrade to version 5.0 or later. Developers should promptly update their dependencies to ensure the security of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for feedparser →
FAQ
Universal Feed Parser (feedparser) is a Python library used for parsing RSS and Atom feeds. It provides a convenient way to extract and process data from various feed formats.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking or theft of sensitive information.
The vulnerability in feedparser.py arises from improper neutralization of user-controlled input during web page generation. By exploiting nested CDATA stanzas, attackers can inject their own web script or HTML into the generated pages.
The consequences of this vulnerability include session hijacking, defacement of web pages, or theft of sensitive information. Attackers can exploit the injected code to perform malicious actions on the affected web application.
To fix this vulnerability, it is recommended to upgrade to Universal Feed Parser version 5.0 or later. This version includes the necessary fixes to properly neutralize user-controlled input and prevent the injection of malicious code.
Related vulnerabilities
Recent vulnerabilities recorded for feedparser.
