Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks
    via a crafted .xlsx document. (CVE-2017-5992)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4821-1 advisory.

    It was discovered that openpyxl incorrectly handled certain documents. A remote attacker could possibly     use this issue to cause a denial of service or other unspecified impact.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python3-openpyxl fixes one security issue :

  - CVE-2017-5992: Prevent resolving external entities by     default, which allowed remote attackers to conduct XXE     attacks via a crafted .xlsx document (bsc#1025592).

This update for python-openpyxl fixes one issue.

This security issue was fixed :

  - CVE-2017-5992: Prevent resolving external entities by     default, which allowed remote attackers to conduct XXE     attacks via a crafted .xlsx document (bsc#1025592).

ID	Name	Product	Family	Severity
413925	SCA: security update for openpyxl (GHSA-chqf-hx79-gxc6)	Tenable Cloud Security	SCA Checks	medium
413925	SCA: security update for openpyxl (GHSA-chqf-hx79-gxc6)	Tenable Self-Hosted Container Security	SCA Checks	medium
183717	Ubuntu 16.04 ESM : openpyxl vulnerability (USN-4821-1)	Nessus	Ubuntu Local Security Checks	high
106963	openSUSE Security Update : python3-openpyxl (openSUSE-2018-202)	Nessus	SuSE Local Security Checks	high
106071	openSUSE Security Update : python-openpyxl (openSUSE-2018-44)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-5992

medium

Tenable Plugins

medium

medium

high

high

high