PyPI: gdal
SFTY-20241106-79481
Safety legacy ID: pyup.io-74054
Affected versions of GDAL's GMLAS driver are vulnerable to XML Entity Expansion attacks (Billion Laughs attack). This vulnerability can lead to a Denial of Service (DoS) by causing excessive resource consumption when parsing specially crafted XML files with recursive entity definitions. The attack vector involves feeding malicious XML content to the GMLAS driver, exploiting the unlimited entity expansion during parsing. The vulnerability exists in the GMLASReader class's XML parsing functions that lack restrictions on entity expansion. An attacker can exploit this by providing a crafted XML input to any application using the vulnerable GMLAS driver, potentially rendering the application unresponsive. The issue is mitigated by introducing a limit on entity expansions and aborting parsing when the limit is exceeded.
Overview
Affected versions of GDAL's GMLAS driver are vulnerable to XML Entity Expansion attacks (Billion Laughs attack). This vulnerability can lead to a Denial of Service (DoS) by causing excessive resource consumption when parsing specially crafted XML files with recursive entity definitions. The attack vector involves feeding malicious XML content to the GMLAS driver, exploiting the unlimited entity expansion during parsing. The vulnerability exists in the GMLASReader class's XML parsing functions that lack restrictions on entity expansion. An attacker can exploit this by providing a crafted XML input to any application using the vulnerable GMLAS driver, potentially rendering the application unresponsive. The issue is mitigated by introducing a limit on entity expansions and aborting parsing when the limit is exceeded.
Advisory
Affected versions of GDAL's GMLAS driver are vulnerable to XML Entity Expansion attacks (Billion Laughs attack). This vulnerability can lead to a Denial of Service (DoS) by causing excessive resource consumption when parsing specially crafted XML files with recursive entity definitions. The attack vector involves feeding malicious XML content to the GMLAS driver, exploiting the unlimited entity expansion during parsing. The vulnerability exists in the GMLASReader class's XML parsing functions that lack restrictions on entity expansion. An attacker can exploit this by providing a crafted XML input to any application using the vulnerable GMLAS driver, potentially rendering the application unresponsive. The issue is mitigated by introducing a limit on entity expansions and aborting parsing when the limit is exceeded.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more