Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause
    a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded
    document. (CVE-2012-2921)

Updated python-feedparser package fixes security vulnerability :

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document (CVE-2012-2921).

Update from 5.1 to 5.1.2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that feedparser did not properly sanitize ENTITY declarations in encoded fields. A remote attacker could exploit this to cause a denial of service via memory exhaustion.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422600	SCA: security update for feedparser (GHSA-hjf3-r7gw-9rwg)	Tenable Cloud Security	SCA Checks	high
422600	SCA: security update for feedparser (GHSA-hjf3-r7gw-9rwg)	Tenable Self-Hosted Container Security	SCA Checks	high
66130	Mandriva Linux Security Advisory : python-feedparser (MDVSA-2013:118)	Nessus	Mandriva Local Security Checks	medium
59337	Fedora 17 : python-feedparser-5.1.2-2.fc17 (2012-8291)	Nessus	Fedora Local Security Checks	medium
59238	Ubuntu 12.04 LTS : feedparser vulnerability (USN-1449-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-2921

high

Tenable Plugins

high

high

medium

medium

medium