CVE-2009-5065: XSS
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.
Other sources
The Python Feed Parser program (python-feedparser) recently released version 5.0.1 with the following fixes:
Fix issue 91 (invalid text in XML declaration causes sanitizer to crash) Fix issue 254 (sanitization can be bypassed by malformed XML comments) Fix issue 255 (sanitizer doesn't strip unsafe URI schemes)
Giving the code a quick look, I don't believe the latter two issues affected 4.1 (possibly introduced in the 5.0 release). The first issue was reported against version 4.1 so would affect what we currently ship in Fedora and EPEL.
Version 5.0.1 corrects these flaws. It may be worthwhile to update to the latest version as the 5.0 release corrected a number of bugs and adds CSS/HTML5 sanitization.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5065?
The severity of CVE-2009-5065 is medium, with a score of 6.1.
What type of vulnerability is CVE-2009-5065?
CVE-2009-5065 is identified as a cross-site scripting (XSS) vulnerability.
How can I fix CVE-2009-5065?
To fix CVE-2009-5065, you should apply the available patch to the Universal Feed Parser.
What systems are affected by CVE-2009-5065?
CVE-2009-5065 affects versions of the Universal Feed Parser before 5.0.
What attack vector is used in CVE-2009-5065?
CVE-2009-5065 allows remote attackers to inject arbitrary web scripts or HTML via nested CDATA stanzas.