full-disclosure - [FD] CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities

Open Source and information security mailing list archives

Message-ID: <CAKSZ2QtSxfzpBY3kd4m-XXUVCg9PO9ovEHxFd30GMYwzSY3O7Q@mail.gmail.com>
Date: Tue, 6 May 2014 10:36:45 +0800
From: feer james <pnigos70@...il.com>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com, fulldisclosure@...lists.org
Subject: [FD] CVE Request ---- SOAPpy 0.12.5 Multiple Vulnerabilities

Hello mitre,

*Background*
SOAPpy provides tools for building SOAP clients and servers.The goal of the
SOAPpy team is to provide a full featured SOAP library for Python that is
very simple to use and that fully supports dynamic interaction between
clients and servers.
SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also
support of setting a handler for resolving entity.By tricking this
feature,it'll lead to xxe attack or dtd dos attack.
*Vulnerability details*
Affect version:0.12.5(currently the lastest version)
Type:XXE Attack & Billion laughs attack
*More details*http://www.pnigos.com/?p=260

===========================================This bug was found by
pnig0s@...ebuf.com.
Could you allocate a CVE id for this?
Thanks & Best regards,pnig0s

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives