{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mofh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-11T18:06:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:\n\n- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.  \n- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.\n\nThe Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.\n\n### Workarounds\nFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost\u0027s API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.\n\nAnother workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.",
  "id": "GHSA-7r9x-qrpr-3cxw",
  "modified": "2022-08-11T18:06:05Z",
  "published": "2022-08-11T18:06:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Wallvon/mofh/security/advisories/GHSA-7r9x-qrpr-3cxw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Wallvon/mofh/commit/da0d33cfd368e2f237ab28bf7a7f00e3d281005a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Wallvon/mofh"
    },
    {
      "type": "WEB",
      "url": "https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "mofh Vulnerable to Improper Restriction of XML External Entity Reference"
}