Description
SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-soappy | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | soappy | < 0.12.6 | 0.12.6 | GHSA-2gh8-gr6x-7q26 |
References
- 20140506 CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities mailing-list
- [oss-security] 20140506 CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities mailing-list
- http://www.pnigos.com/?p=260
- 67216 vdb-entry
- [oss-security] 20140506 Re: CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities mailing-list