New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability using xml.etree.ElementTree #777

Open

ElvertMora opened this issue Mar 22, 2022 · 0 comments

ElvertMora commented Mar 22, 2022

in the file https://github.com/chaoss/grimoirelab-perceval/blob/master/perceval/utils.py

should don't using xml.etree.ElementTree see:

you can get this vulnerabilities :

CVE-2022-25235
CVE-2022-22822
CVE-2022-22824
CVE-2022-23852
CVE-2022-25236
CVE-2022-22823
CVE-2022-25315
CVE-2022-23990
CVE-2022-23219
CVE-2022-23218
CVE-2019-25013
CVE-2021-33574
CVE-2013-7445
CVE-2021-38300
CVE-2021-3752
CVE-2021-3520
CVE-2021-3737
the correct way going is use the defusedxml Package

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment