CVE-2020-29128: XML Injection in petl
Summary
CVE-2020-29128: Duplicate Advisory: XML Injection in petl. Affects petl versions < 1.6.8. Fixed in 1.6.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
petl is a Python package available on PyPI that provides a set of utilities for working with tabular data. It offers functions and classes for reading, manipulating, and writing data in various formats. petl is widely used in data processing and analysis workflows. However, versions before 1.68 are vulnerable to XML injection in certain configurations.
Vulnerability Detail
The XML injection vulnerability in petl allows for the resolution of entities in an XML document. This can lead to various security issues, including the potential for remote code execution, information disclosure, and denial of service attacks. The vulnerability arises from improper handling of user-supplied input, which can be exploited to manipulate the XML structure and execute unintended actions.
How To Fix
Minimum fixed version
1.6.8
This is the first release that contains the fix.
pip install --upgrade "petl==1.6.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of petl to ensure the security of your application.
Conclusion
The XML injection vulnerability in petl can have severe security implications, including the potential for remote code execution and information disclosure. It is crucial to update to the fixed version (1.6.8 or later) to mitigate these risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for petl →
FAQ
XML injection is a type of attack where an attacker manipulates XML input to exploit vulnerabilities in an application. It can lead to various security risks, including remote code execution, information disclosure, and denial of service.
The XML injection vulnerability in petl can allow an attacker to manipulate XML input, potentially leading to remote code execution, information disclosure, or denial of service attacks. It is crucial to update to the fixed version to mitigate these risks.
No, only versions before 1.68 of petl are affected by this XML injection vulnerability. It is recommended to upgrade to version 1.6.8 or later to address the issue.
No, there is no known workaround for this vulnerability. It is necessary to update to the fixed version of petl to ensure the security of your application.
To update your petl installation to the fixed version (1.6.8 or later), you can use the following command:
pip install --upgrade petl
