Openpyxl XML External Entity Injection Vulnerability

Openpyxl is a Python library for reading and writing Excel 2010. An XML external entity injection vulnerability exists in Openpyxl version 2.4.1. A remote attacker can exploit this vulnerability to read a local file with the help of a specially crafted document, resulting in a denial of service t...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

DEBIAN-CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

airtestproject (>=0.1.0 <=0.1.2), commcaretranslationchecker (>=0.9.2 <=0.9.2.41) +11 more potentially affected by CVE-2017-5992 via openpyxl (>=1.1.0 <=2.4.0)

openpyxl PYPI version =1.1.0, =0.1.0, =0.9.2, =3.1.10, =0.8.2, =0.2.0, =1.3.0, =0.1.0, =0.9.0, =0.9.0, =1.6.0, =0.1.3.5, =1.6.2 Source cves: CVE-2017-5992 Source advisory: OSV:PYSEC-2017-48...

PYSEC-2017-48

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

Xxe

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

UBUNTU-CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

PYSEC-2017-48

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2017-5992

Openpyxl version 2.4.1 is affected by CVE-2017-5992 due to default handling of external entities, enabling XXE via a crafted .xlsx file. Multiple feeds (GHSA, USN, OSV, OpenVAS) corroborate the issue and reference fixed package updates: python36-openpyxl-3.0.7-1.2 and python310-openpyxl-3.1.3-1.1...

XML External Entity (XXE)

openpyxl is vulnerable to XML external entity. The vulnerability is possible because it adopts lxml which by default does resolve external entities...