CVE-2022-37189

Advisory

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37189
• https://github.com/DDMAL/MEI2Volpiano/
• https://docs.python.org/3/library/xml.html#xml-vulnerabilities
• https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
• https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59