CVE-2019-1010268: ladon - Improper Restriction of XML External Entity Reference
Summary
CVE-2019-1010268: Improper Restriction of XML External Entity Reference in ladon. Affects ladon versions >= 0.6.1, <= 1.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ladon is a Python package available on PyPI that provides a framework for creating SOAP web services. It allows developers to define service methods and expose them as SOAP endpoints. The package is widely used for building web services in Python applications. However, versions of ladon from 0.6.1 to 1.0.7 are affected by an XML External Entity (XXE) vulnerability.
Vulnerability Detail
The XXE vulnerability in ladon allows an attacker to perform information disclosure, read files, and potentially reach internal network endpoints. The vulnerability is present in the SOAP request handlers of ladon, specifically in the 'ladon.interfaces.soap.SOAPRequestHandler.parse_request' function. By sending a specially crafted SOAP call, an attacker can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update ladon to a non-vulnerable version.
Conclusion
The ladon package, versions 0.6.1 to 1.0.7, is affected by an XML External Entity (XXE) vulnerability. This vulnerability allows an attacker to perform information disclosure and potentially reach internal network endpoints. It is crucial to update ladon to a version beyond 1.0.7 to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ladon →
FAQ
ladon is a Python package used for creating SOAP web services.
The vulnerability allows an attacker to perform information disclosure, read files, and potentially reach internal network endpoints.
Versions of ladon from 0.6.1 to 1.0.7 are affected by this vulnerability.
To fix this vulnerability, update ladon to a version beyond 1.0.7.
There is no specific workaround mentioned for this vulnerability. Updating ladon to a non-vulnerable version is the recommended approach.
