Is CVE-2011-1157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2011-1157 being exploited in the wild.

How severe is CVE-2011-1157?

Low severity, with a CVSS score of 3.1, published 11 April 2011.

Which products and versions are affected?

feedparser (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.1, ECOSYSTEM:introduced=5.0,fixed=5.0.1.

Is there a fix for CVE-2011-1157?

Yes. feedparser (PyPI): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2011-1157 attacked?

It is attacked over the network.

Am I affected by CVE-2011-1157?

Check whether you run feedparser (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2011-1157: feedparser Cross-site Scripting in XML comment parsing

CVE-2011-1157 · Severity: low · CVSS 3.1 · Published 2011-04-11

feedparser is a widely-used library for parsing RSS and Atom feeds in Python applications. A cross-site scripting (XSS) vulnerability in versions 5.0 and 5.0 allows attackers to inject malicious JavaScript or HTML by crafting feeds with malformed XML comments. When a vulnerable application uses feedparser to process untrusted feeds and displays the parsed content in a web browser, an attacker can steal user sessions, credentials, or perform actions on behalf of the user.

Technologies: feedparser (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2011-1157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2011-1157 being exploited in the wild.
How severe is CVE-2011-1157?: Low severity, with a CVSS score of 3.1, published 11 April 2011.
Which products and versions are affected?: feedparser (PyPI) ECOSYSTEM:introduced=0,fixed=5.0.1, ECOSYSTEM:introduced=5.0,fixed=5.0.1.
Is there a fix for CVE-2011-1157?: Yes. feedparser (PyPI): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2011-1157 attacked?: It is attacked over the network.
Am I affected by CVE-2011-1157?: Check whether you run feedparser (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

feedparser (PyPI): upgrade to 5.0.1 or later
```
pip install "feedparser>=5.0.1"
```

Technical details

A cross-site scripting (XSS) vulnerability exists in feedparser.py in Universal Feed Parser versions 5.x before 5.0.1, caused by improper sanitization of XML comments during feed parsing. The vulnerable component fails to properly escape or filter malformed XML comment content before returning it to the caller. An attacker can supply a specially crafted feed containing injected script or HTML within XML comments; if the application displays this parsed content without additional sanitization, the payload executes in the victim's browser. The vulnerability requires user interaction (visiting a page that processes the feed) and network access to the feed source. Patches are available in version 5.0.1 and later.

Affected products

feedparser feedparser 5.0, 5.0

Identifiers

CVE-2011-1157
GHSA-2p78-8hh6-96xc
PYSEC-2011-20

Timeline

2011-03: disclosed: Vulnerability reported to oss-security mailing list
2011: patched: Fixed in feedparser 5.0.1
2018-07-23: advisory: GitHub advisory GHSA-2p78-8hh6-96xc published

References

https://bugzilla.novell.com/show_bug.cgi?id=680074

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.