Ubuntu 16.04 ESM : openpyxl vulnerability (USN-4821-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4821-1 advisory. It was discovered that openpyxl incorrectly handled certain documents. A remote attacker could possibly use this issue to cause a denial of service or other...

commcaretranslationchecker (>=0.9.2, <=0.9.2.41), data-importer (3.1.1) +10 more potentially affected by CVE-2017-5992 via openpyxl (>=2.0.5, <=2.4.1)

openpyxl PYPI version =2.0.5, =0.9.2, =3.1.10, =0.8.2, =0.2.0, =1.3.0, =0.9.0, =0.1.7b0, =0.9.0, =1.6.0, =0.1.3.5, =1.6.2 Source cves: CVE-2017-5992 Source advisory: GHSA-CHQF-HX79-GXC6...

openSUSE Security Update : python3-openpyxl (openSUSE-2018-202)

This update for python3-openpyxl fixes one security issue : - CVE-2017-5992: Prevent resolving external entities by default, which allowed remote attackers to conduct XXE attacks via a crafted .xlsx document bsc1025592. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE Security Update : python-openpyxl (openSUSE-2018-44)

This update for python-openpyxl fixes one issue. This security issue was fixed : - CVE-2017-5992: Prevent resolving external entities by default, which allowed remote attackers to conduct XXE attacks via a crafted .xlsx document bsc1025592. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

commcaretranslationchecker (>=0.9.2, <=0.9.2.41), data-importer (3.1.1) +9 more potentially affected by CVE-2017-5992 via openpyxl (>=2.0.5, <=2.4.0)

openpyxl PYPI version =2.0.5, =0.9.2, =3.1.10, =0.8.2, =0.2.0, =1.3.0, =0.9.0, =0.9.0, =1.6.0, =0.1.3.5, =1.6.2 Source cves: CVE-2017-5992 Source advisory: OSV:PYSEC-2017-48...

airtestproject (>=0.1.0, <=0.1.2) potentially affected by CVE-2017-5992 via openpyxl (1.1.0)

openpyxl PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on openpyxl and may be impacted: - airtestproject =0.1.0, =0.1.2 Source cves: CVE-2017-5992 Source advisory: OSV:PYSEC-2017-48...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

airtestproject (>=0.1.0, <=0.1.2), commcaretranslationchecker (>=0.9.2, <=0.9.2.41) +12 more potentially affected by CVE-2017-5992 via openpyxl (>=1.1.0, <=2.4.1)

openpyxl PYPI version =1.1.0, =0.1.0, =0.9.2, =3.1.10, =0.8.2, =0.2.0, =1.3.0, =0.1.0, =0.9.0, =0.1.7b0, =0.9.0, =1.6.0, =0.1.3.5, =1.6.2 Source cves: CVE-2017-5992 Source advisory: MEND:CVE-2017-5992...

CVE-2017-5992

Openpyxl version 2.4.1 is affected by CVE-2017-5992 due to default handling of external entities, enabling XXE via a crafted .xlsx file. Multiple feeds (GHSA, USN, OSV, OpenVAS) corroborate the issue and reference fixed package updates: python36-openpyxl-3.0.7-1.2 and python310-openpyxl-3.1.3-1.1...