Vulnerability · Published Jul 29, 2021 · Assigned by snyk
CVE-2021-23418XML External Entity (XXE) Injection
Medium 6.3
In plain English
A medium-severity security flaw in Glances. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.7%top 23.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glances | 3.2.3.1+dfsg-1 | DEBIAN-CVE-2021-23418 |
| Debian:13 | glances | 3.2.3.1+dfsg-1 | DEBIAN-CVE-2021-23418 |
| Debian:14 | glances | 3.2.3.1+dfsg-1 | DEBIAN-CVE-2021-23418 |
| PyPI | glances | 3.2.1 | GHSA-r2mj-8wgq-73m6 |
| PyPI | glances | 3.2.1 | PYSEC-2021-115 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-PYTHON-GLANCES-1311807 x_refsource_MISC
- https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94 x_refsource_MISC
- https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a x_refsource_MISC
- https://github.com/nicolargo/glances/issues/1025 x_refsource_MISC
- https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32 x_refsource_MISC