id: PYSEC-2020-59
details: '** DISPUTED ** TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII
  through 0.2.0 and other products, allows SSRF via an initial http:// substring to
  the parse method, even when the no_network setting is used for the XML parser. NOTE:
  the vendor points out that the parse method "wraps the lxml library" and that this
  may be an issue to "raise ... to the lxml group."'
affected:
- package:
    name: libtaxii
    ecosystem: PyPI
    purl: pkg:pypi/libtaxii
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.1.118
  versions:
  - 1.0.090
  - 1.0.100
  - 1.0.101
  - 1.0.103
  - 1.0.104
  - 1.0.105
  - 1.0.106
  - 1.0.107
  - 1.1.100
  - 1.1.101
  - 1.1.102
  - 1.1.103
  - 1.1.104
  - 1.1.105
  - 1.1.106
  - 1.1.107
  - 1.1.108
  - 1.1.109
  - 1.1.110
  - 1.1.111
  - 1.1.112
  - 1.1.113
  - 1.1.114
  - 1.1.115
  - 1.1.116
  - 1.1.117
references:
- type: REPORT
  url: https://github.com/TAXIIProject/libtaxii/issues/246
- type: REPORT
  url: https://github.com/eclecticiq/OpenTAXII/issues/176
- type: WEB
  url: http://packetstormsecurity.com/files/159662/Libtaxii-1.1.117-OpenTaxi-0.2.0-Server-Side-Request-Forgery.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-836c-xg97-8p4h
aliases:
- CVE-2020-27197
- GHSA-836c-xg97-8p4h
modified: '2020-10-27T19:51:00Z'
published: '2020-10-17T20:15:00Z'