CVE-2017-5992 Improper Restriction of XML External Entity Reference in Openpyxl
Remote attackers can exploit external entity resolution in Openpyxl to read sensitive files or cause denial of service via crafted Excel documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-5992?
CVE-2017-5992 is a high-severity vulnerability in n/a, published on 15 Feb 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
Weakness: CWE-611
Which versions are affected by CVE-2017-5992?
3 open source packages ship an affected version, including openpyxl. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openpyxl PyPI | All versions | 2.4.1 |
openpyxl PyPI | All versions | 2.4.2 |
openpyxl PyPI | All versions | 2.4.2 |
Linux distribution packages (2)
python-openpyxl openSUSE:Tumbleweed | All versions | 3.1.3-1.1 |
python-openpyxl openSUSE:Tumbleweed | All versions | 3.1.5-1.8 |
Products include Python Openpyxl.
How do I fix CVE-2017-5992?
Upgrade openpyxl to a fixed version for your release line: 2.4.1 or 2.4.2.
Is CVE-2017-5992 being exploited?
There is no known exploitation of CVE-2017-5992 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-5992, GHSA-chqf-hx79-gxc6, PYSEC-2017-48, UBUNTU-CVE-2017-5992, USN-4821-1, openSUSE-SU-2024:11248-1 and 2 more.