CVE-2020-27197: libtaxii Server-Side Request Forgery vulnerability
(updated )
“TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method “wraps the lxml library” and that this may be an issue to “raise … to the lxml group.””
References
- github.com/TAXIIProject/libtaxii
- github.com/TAXIIProject/libtaxii/commit/23c6f7b69d99e965c8d53dc4710ae64da3fb4842
- github.com/TAXIIProject/libtaxii/issues/246
- github.com/TAXIIProject/libtaxii/pull/247
- github.com/advisories/GHSA-836c-xg97-8p4h
- github.com/eclecticiq/OpenTAXII/issues/176
- github.com/pypa/advisory-database/tree/main/vulns/libtaxii/PYSEC-2020-59.yaml
- nvd.nist.gov/vuln/detail/CVE-2020-27197
Code Behaviors & Features
Detect and mitigate CVE-2020-27197 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →