Skip to content
OpenAdvisories
Medium USN-5187-1 1 CVE

glances vulnerability

Published Jul 25, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Glances incorrectly parsed untrusted XML data due to
usage of xmlrpclib. An attacker could possibly use this to perform an External
Entity (XXE) Injection and cause the host system to crash.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS glances 2.3-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS glances 2.11.1-3ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS glances 3.1.3-1ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.3
    CVE-2021-23418

    XML External Entity (XXE) Injection

    The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

    glances glances glances Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-23418