CVE-2021-25951: XML Entity Expansion in xml2dict
Summary
CVE-2021-25951: XML2Dict XML Entity Expansion Vulnerability. Affects xml2dict versions < 0.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xml2dict package is a Python library available on PyPI that provides functionality for converting XML data into Python dictionaries. It is commonly used for parsing and manipulating XML files in Python applications. However, versions up to and including 0.2.2 of xml2dict are vulnerable to an XML Entity Expansion (XXE) attack.
Vulnerability Detail
The XXE vulnerability in xml2dict version 0.2.2 allows an attacker to cause a denial of service. The parse function in xml2dict does not properly restrict recursive entity references, which can lead to excessive memory consumption and CPU usage when processing specially crafted XML input. This vulnerability can be exploited by an attacker to exhaust system resources, resulting in a denial of service condition. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a non-vulnerable version of xml2dict to mitigate the risk.
Conclusion
The XML Entity Expansion vulnerability in xml2dict version 0.2.2 can lead to a denial of service condition. It is crucial to update to a non-vulnerable version of xml2dict to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xml2dict →
FAQ
xml2dict is a Python library that converts XML data into Python dictionaries. It is commonly used for parsing and manipulating XML files in Python applications.
An XML Entity Expansion attack is a type of attack where an attacker exploits the ability of XML parsers to process external entities. By including specially crafted XML entities, an attacker can cause excessive memory consumption and CPU usage, leading to a denial of service.
This vulnerability allows an attacker to cause a denial of service by exhausting system resources. It can lead to system instability and unavailability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just Pipfile.lock without requiring access to the code or installation.
To fix this vulnerability, you should update your xml2dict dependency to a version higher than 0.2.2. This will ensure that the vulnerability is patched and your application is no longer at risk.
