vulnwire
8.8high

CVE-2016-5851

Improper Restriction of XML External Entity Reference in python-docx

Also known as GHSA-34wj-p5jm-2p96, PYSEC-2016-21

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Exploit prediction (EPSS)

2.35% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypipython-docx
<0.8.6
0.8.6

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

  • openwall.com /lists/oss-security/2016/06/28/7 · mailing-list, x_transferred
  • openwall.com /lists/oss-security/2016/06/28/8 · mailing-list, x_transferred
  • github.com /python-openxml/python-docx/blob/v0.8.6/HISTORY.rst · x_transferred
  • securityfocus.com /bid/91485 · vdb-entry, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX · vendor-advisory, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHA · vendor-advisory, x_transferred
  • github.com /python-openxml/python-docx/commit/61b40b161b64173ab8e362aec1fd197948431beb · x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-5851 · advisory
  • github.com /advisories/GHSA-34wj-p5jm-2p96 · advisory
  • github.com /pypa/advisory-database/tree/main/vulns/python-docx/PYSEC-2016-21.yaml · web
  • github.com /python-openxml/python-docx · package
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX · web
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHA · web
  • lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/6FFMOH7ZPOPQWNJGUZOS5LXX4M · web
  • lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/XU2WSYRNB7CLBBFCGSX34XHACT · web
  • web.archive.org /web/20170214030949/http://www.securityfocus.com/bid/91485 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.