CVE-2020-29128

EUVD-2020-0127
petl before 1.68, in some configurations, allows resolution of entities in an XML document.
aka Blind XPath Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
petl_projectpetl
𝑥
< 1.6.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8
https://github.com/petl-developers/petl/issues/526
https://github.com/petl-developers/petl/pull/527
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347
https://petl.readthedocs.io/en/stable/changes.html
https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md
https://github.com/petl-developers/petl/compare/v1.6.7...v1.6.8
https://github.com/petl-developers/petl/issues/526
https://github.com/petl-developers/petl/pull/527
https://github.com/petl-developers/petl/pull/527/commits/1b0a09f08c3cdfe2e69647bd02f97c1367a5b5f8
https://github.com/petl-developers/petl/security/advisories/GHSA-f5gc-p5m3-v347
https://petl.readthedocs.io/en/stable/changes.html