CVE-2020-29128

Description

petl before 1.68, in some configurations, allows resolution of entities in an XML document.

How to fix CVE-2020-29128

To remediate CVE-2020-29128, upgrade the affected package to a fixed version below.

• PyPI/petl—upgrade to 1.6.8 or later
• PyPI/petl—upgrade to 1.6.8 or later
• PyPI/petl—upgrade to 1.6.8 or later

Is CVE-2020-29128 being exploited?

Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1.6.8
• from 0, < 1.6.8
• from 0, < 1.6.8

CVSS scores

References (14)

• ADVISORYgithub.com/advisories/GHSA-69q2-p9xp-739v
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-29128
• PATCHgithub.com/petl-developers/petl
• WEBgithub.com/nvn1729/advisories/blob/master/cve-2020-29128.md