What is GHSA-m8gq-83gh-v42v?

GHSA-m8gq-83gh-v42v is a security advisory published by GitHub Security Advisories with Medium severity. XML External Entities Vulnerability in CVRF-CSAF-Converter

Which CVE IDs does GHSA-m8gq-83gh-v42v cover?

GHSA-m8gq-83gh-v42v covers the following CVE IDs: CVE-2022-27193. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m8gq-83gh-v42v?

GHSA-m8gq-83gh-v42v has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-m8gq-83gh-v42v?

GHSA-m8gq-83gh-v42v affects 1 product, including: pip/cvrf2csaf:\u003c= 1.0.0rc1.

GHSA-m8gq-83gh-v42vMediumCVSS 6.1

XML External Entities Vulnerability in CVRF-CSAF-Converter

Vendor

GitHub Security Advisories

Published

March 16, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-27193 →

📋 Description

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.

🎯 Affected products1

pip/cvrf2csaf:<= 1.0.0rc1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-27193
https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2
https://github.com/advisories/GHSA-m8gq-83gh-v42v