mailing list archives
CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities
From: feer james <pnigos70 () gmail com>
Date: Tue, 6 May 2014 10:36:45 +0800
SOAPpy provides tools for building SOAP clients and servers.The goal of the
SOAPpy team is to provide a full featured SOAP library for Python that is
very simple to use and that fully supports dynamic interaction between
clients and servers.
SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also
support of setting a handler for resolving entity.By tricking this
feature,it'll lead to xxe attack or dtd dos attack.
Affect version:0.12.5(currently the lastest version)
Type:XXE Attack & Billion laughs attack
===========================================This bug was found by
pnig0s () freebuf com
Could you allocate a CVE id for this?
Thanks & Best regards,pnig0s
Sent through the Full Disclosure mailing list
Web Archives & RSS: http://seclists.org/fulldisclosure/
- CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities feer james (May 06)