crítica
CVE-2021-23418
The package glances before 3.2.1 are vulnerable to XML External Entity ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Ubuntu (media).
Descripción
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | glances | sin corrección indicada |
| debian 11 | glances | sin corrección indicada |
| debian 12 | glances | 3.2.3.1+dfsg-1 |
| debian 13 | glances | 3.2.3.1+dfsg-1 |
| debian 14 | glances | 3.2.3.1+dfsg-1 |
| debian 9 | glances | sin corrección indicada |
| echo | glances | 3.2.3.1+dfsg-1 |
| pip::GitHub Security Advisory pip | glances | 3.2.1 |
| ubuntu 16.04-ESM | glances | 2.3-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | glances | 2.11.1-3ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | glances | 3.1.3-1ubuntu0.1~esm1 |
Referencias
- https://github.com/advisories/GHSA-r2mj-8wgq-73m6
- https://github.com/nicolargo/glances
- https://github.com/nicolargo/glances/commit/4b87e979afdc06d98ed1b48da31e69eaa3a9fb94
- https://github.com/nicolargo/glances/commit/85d5a6b4af31fcf785d5a61086cbbd166b40b07a
- https://github.com/nicolargo/glances/commit/9d6051be4a42f692392049fdbfc85d5dfa458b32
- https://github.com/nicolargo/glances/issues/1025
- https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2021-115.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2021-23418