Lucene search

Ubuntu.comUB:CVE-2024-37388

HistoryJun 07, 2024 - 12:00 a.m.

CVE-2024-37388

2024-06-0700:00:00

ubuntu.com

xml

xxe

vulnerability

ebookmeta

lxml

denial of service

dos

crafted xml

unix

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata
function of lxml before v4.9.1 allows attackers to access sensitive
information or cause a Denial of Service (DoS) via crafted XML input.

Notes

Author	Note
mdeslaur	this appears to be an issue in ebookmeta, not in lxml itself

References

github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335

launchpad.net/bugs/cve/CVE-2024-37388

nvd.nist.gov/vuln/detail/CVE-2024-37388

security-tracker.debian.org/tracker/CVE-2024-37388

www.cve.org/CVERecord?id=CVE-2024-37388