| Summary: | <sys-process/glances-3.1.7: unsafe XML parsing | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | John Helmert III <ajak> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | gyakovlev |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://github.com/nicolargo/glances/issues/1025 | ||
| Whiteboard: | B2 [glsa+] | ||
| Package list: |
sys-process/glances-3.2.1
|
Runtime testing required: | --- |
bumped in https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=429217398964cc9e867dd802b4b98c677764a42e Thank you! Unable to check for sanity:
> no match for package: sys-process/glances-3.1.7
All sanity-check issues have been resolved amd64 stable x86 done arm64 done arm done ppc64 done, last arch The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9924df5a5674be8968875b806ad309d3662df0b5 commit 9924df5a5674be8968875b806ad309d3662df0b5 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2021-07-13 05:52:29 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2021-07-13 05:52:29 +0000 sys-process/glances: drop 3.1.6.2 Bug: https://bugs.gentoo.org/791565 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> sys-process/glances/Manifest | 1 - sys-process/glances/glances-3.1.6.2.ebuild | 87 ------------------------------ 2 files changed, 88 deletions(-) Unable to check for sanity:
> no match for package: sys-process/glances-3.2.1
cleanup done. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=b1cfcda7a8b39747e2e84f98c62aa12c3804f4e9 commit b1cfcda7a8b39747e2e84f98c62aa12c3804f4e9 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-02-26 12:07:09 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-02-26 12:07:31 +0000 [ GLSA 202402-30 ] Glances: Arbitrary Code Execution Bug: https://bugs.gentoo.org/791565 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202402-30.xml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) |
Issue includes Bandit output: Issue: [B411:blacklist] Using Fault to parse untrusted XML data is known to be vulnerable to XML attacks. Use defused.xmlrpc.monkey_patch() function to monkey-patch xmlrpclib and mitigate XML vulnerabilities. Severity: High Confidence: High Location: glances/compat.py:91 90 from SimpleXMLRPCServer import SimpleXMLRPCRequestHandler, SimpleXMLRPCServer 91 from xmlrpclib import Fault, ProtocolError, ServerProxy, Transport 92 from urllib2 import urlopen, URLError Fix in 3.1.7, please bump.