Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-115399: Document CVE-2023-52425 under "XML vulnerabilities"#115400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletionsDoc/library/xml.rst
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -68,6 +68,7 @@ quadratic blowup **Vulnerable** (1) **Vulnerable** (1) **Vulnerable*
external entity expansion Safe (5) Safe (2) Safe (3) Safe (5) Safe (4)
`DTD`_ retrieval Safe (5) Safe Safe Safe (5) Safe
decompression bomb Safe Safe Safe Safe **Vulnerable**
large tokens **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6)
========================= ================== ================== ================== ================== ==================

1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and
Expand All@@ -81,6 +82,11 @@ decompression bomb Safe Safe Safe
4. :mod:`xmlrpc.client` doesn't expand external entities and omits them.
5. Since Python 3.7.1, external general entities are no longer processed by
default.
6. Expat 2.6.0 and newer is not vulnerable to denial of service
through quadratic runtime caused by parsing large tokens.
Items still listed as vulnerable due to
potential reliance on system-provided libraries. Check
:const:`!pyexpat.EXPAT_VERSION`.


billion laughs / exponential entity expansion
Expand DownExpand Up@@ -114,6 +120,13 @@ decompression bomb
files. For an attacker it can reduce the amount of transmitted data by three
magnitudes or more.

large tokens
Expat needs to re-parse unfinished tokens; without the protection
introduced in Expat 2.6.0, this can lead to quadratic runtime that can
be used to cause denial of service in the application parsing XML.
The issue is known as
`CVE-2023-52425 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52425>`_.

The documentation for `defusedxml`_ on PyPI has further information about
all known attack vectors with examples and references.

Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
Document CVE-2023-52425 of Expat <2.6.0 under "XML vulnerabilities".
[8]ページ先頭
©2009-2025 Movatter.jp