GMS-2022-3574: mofh Vulnerable to Improper Restriction of XML External Entity Reference

August 11, 2022

The xml.etree.ElementTree module that mofh used up until version 1.0.1 implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to Billion Laughs attack. It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities.

References

github.com/Wallvon/mofh/commit/da0d33cfd368e2f237ab28bf7a7f00e3d281005a
github.com/Wallvon/mofh/security/advisories/GHSA-7r9x-qrpr-3cxw
github.com/advisories/GHSA-7r9x-qrpr-3cxw
www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/

Code Behaviors & Features

Detect and mitigate GMS-2022-3574 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →