CVE-2021-23418 XML External Entity (XXE) Injection
An attacker can exploit XML External Entity injection in Glances to read sensitive data or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23418?
CVE-2021-23418 is a medium-severity vulnerability in Glances, published on 29 Jul 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Weakness: CWE-611
Which versions are affected by CVE-2021-23418?
3 open source packages ship an affected version, including glances and Glances. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
glances PyPI | All versions | 3.2.1 |
glances PyPI | All versions | 3.2.1 |
Glances PyPI | All versions | 3.2.1 |
Products include Glances Project Glances.
How do I fix CVE-2021-23418?
Upgrade glances to 3.2.1 or later.
Is CVE-2021-23418 being exploited?
There is no known exploitation of CVE-2021-23418 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-23418, GHSA-r2mj-8wgq-73m6, PYSEC-2021-115, SNYK-PYTHON-GLANCES-1311807, UBUNTU-CVE-2021-23418, USN-5187-1.