Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

petl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.9PyPIAmendedPublished

    XXE in petl

    CVE-2020-29128 · GHSA-f5gc-p5m3-v347

    Affected
    • PyPI petl < 1.6.8
    Fixed in
    1.6.8· Vendor fix available
    Issue
    Impact Information Disclosure Summary petl is a Python library that provides functions for extraction, transformation, and loading (ETL) of data. petl before 1.68, in some configurations, allows resolution of entities in XML input. An attacker who is able to submit XML input to an application using petl can disclose arbitrary files on the file system in the context of the user under which the application is running. Affected Applications Applications that: - accept attacker-supplied XML input that is processed using petl = 1.68 Workarounds - Assure there is no user/external access to the application using petl - Assure your application is not using the function fromxml() References - https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md - https://github.com/petl-developers/petl/pull/527 -…

    Recommended action: Upgrade to 1.6.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →