feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.

The Python Feed Parser program (python-feedparser) recently released version 5.0.1 with the following fixes:

Fix issue 91 (invalid text in XML declaration causes sanitizer to crash) Fix issue 254 (sanitization can be bypassed by malformed XML comments) Fix issue 255 (sanitizer doesn't strip unsafe URI schemes)

Giving the code a quick look, I don't believe the latter two issues affected 4.1 (possibly introduced in the 5.0 release). The first issue was reported against version 4.1 so would affect what we currently ship in Fedora and EPEL.

Version 5.0.1 corrects these flaws. It may be worthwhile to update to the latest version as the 5.0 release corrected a number of bugs and adds CSS/HTML5 sanitization.