Roundup Tracker - Issues

Issue 2551116

classification
Title: Replace xmlrpclib (xmlrpc.client) with defusedxml
Type: security Severity: normal
Components: Web interface Versions: devel
process
Status: new Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: rouilj
Priority: normal Keywords:

Created on 2021-03-14 15:55 by rouilj, last changed 2021-03-14 15:55 by rouilj.

Messages
msg7110 Author: [hidden] (rouilj) Date: 2021-03-14 15:55
From doc/xmlrpc.txt

   Both the standalone and embedded roundup XML endpoints used the
   default python XML parser. This parser is know to have security
   issues. For details see: https://pypi.python.org/pypi/defusedxml/.
   [...] Patches with tests to roundup to use defusedxml are welcome.

I am not sure how many people use the xmlrpc endpoint. The 
vulnerabilities seem to be DOS/resource usage and not remote
code execution/remote data access, so this isn't highly critical.

Vulnerability can be mitigated by limiting xmlrpc access to specific
trusted users. Also the REST interface provides another method for 
accessing data.

defusedxml is located at https://pypi.python.org/pypi/defusedxml/
At this point it supports python versions 2.7.X and > 3.5.
History
Date User Action Args
2021-03-14 15:55:20rouiljcreate