CVE-2019-1010017: XML Injection in python-libnmap
Summary
CVE-2019-1010017: XML Injection in python-libnmap. Affects python-libnmap versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Also tracked for
- python-libnmap · Debian:11
The same CVE-2019-1010017 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-libnmap is a Python library that provides a convenient interface for interacting with the Nmap security scanner. It allows users to programmatically execute Nmap scans, parse the results, and perform various operations on the scan data. The library relies on XML parsing to handle the Nmap output. However, it is susceptible to XML Injection, which can lead to a denial of service (DoS) attack by consuming excessive resources.
Vulnerability Detail
The XML Injection vulnerability in python-libnmap arises from a lack of proper input validation and sanitization when parsing XML payloads. An attacker can exploit this vulnerability by crafting a specially designed XML payload that contains malicious content. When the library processes this payload, it can lead to resource exhaustion, resulting in a DoS condition. The attack vector for this vulnerability is through the XML parsing functionality of the library.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
pip install --upgrade "python-libnmap==0.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional input validation and sanitization measures when processing XML payloads with python-libnmap. This can include using XML parsing libraries with built-in protection against XML Injection vulnerabilities or implementing custom input validation routines to ensure the XML content is safe before passing it to the library.
Conclusion
The XML Injection vulnerability in python-libnmap can be mitigated by updating to a patched version of the library and implementing proper input validation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-libnmap →
FAQ
python-libnmap is a Python library that provides an interface for interacting with the Nmap security scanner.
XML Injection is a vulnerability that occurs when an application does not properly validate and sanitize user-supplied XML input, allowing an attacker to inject malicious content into the XML data.
The XML Injection vulnerability in python-libnmap can lead to a denial of service (DoS) attack by consuming excessive resources. This can result in degraded performance or unavailability of the affected system.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Updating python-libnmap to a version that includes a patch for the XML Injection issue is the recommended mitigation. Additionally, implementing proper input validation and sanitization measures when processing XML payloads can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-libnmap.
