CVE-2019-1010017: XML Injection in python-libnmap
Summary
CVE-2019-1010017: libnmap < v0.6.3 is affected by: XML Injection. Affects python-libnmap versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Also tracked for
- python-libnmap · Debian:11
The same CVE-2019-1010017 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-libnmap is a Python library that provides a convenient interface to the Nmap security scanner. It allows users to easily interact with Nmap and retrieve scan results. The library is commonly used in network security and vulnerability assessment applications. However, versions prior to 0.6.3 are vulnerable to XML Injection, which can lead to a denial of service (DoS) attack by consuming excessive resources. The vulnerability resides in the XML parsing component of the library.
Vulnerability Detail
The XML Injection vulnerability in python-libnmap allows an attacker to manipulate XML payloads in a way that can cause the application to consume excessive resources, leading to a denial of service condition. By crafting specially designed XML payloads, an attacker can exploit this vulnerability and exhaust system resources, resulting in the unavailability of the affected application. This vulnerability can be triggered by sending malicious XML data to the application's XML parsing functionality.
How To Fix
Minimum fixed version
0.6.3
This is the first release that contains the fix.
pip install --upgrade "python-libnmap==0.6.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The XML Injection vulnerability in python-libnmap can lead to a denial of service (DoS) attack by consuming excessive resources. It is recommended to upgrade to version 0.6.3 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-libnmap →
FAQ
The vulnerability can lead to a denial of service (DoS) attack by consuming excessive resources, resulting in the unavailability of the affected application.
XML Injection is a type of attack where an attacker manipulates XML data in a way that can lead to security vulnerabilities. In this case, the attacker can craft malicious XML payloads to exploit the vulnerability in python-libnmap.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Pipfile.lock and Vulert will analyze it for open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to upgrade python-libnmap to the fixed version.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is crucial to apply the recommended fix to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-libnmap.
