CVE-2021-23418: Improper Restriction of XML External Entity Reference (CWE-611)
value: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2021-07-29T18:15Z
Repository: https://github.com/nicolargo/glances
Language: Python
Files changed: README.rst, glances/compat.py, optional-requirements.txt, requirements.txt, setup.py
Commit date: 2021-07-09 10:03:37 +0200
Commit message: Security audit - B411 #1025

Diff: diff --git a/README.rst b/README.rst
index 90cc80f3..78ef7a87 100644
--- a/README.rst
+++ b/README.rst
@@ -57,17 +57,23 @@ add new plugins or exports modules.
 Requirements
 ============
 
 - ``python>=2.7`` or ``python>=3.4``
 - ``psutil>=5.3.0`` (better with latest version)
+- ``defusedxml`` (in order to monkey path xmlrpc)
+- ``future`` (for Python 2 support)
 
 *Note for Python 2.6 users*
 
 Glances no longer supports Python 2.6. Please upgrade
 to a minimum Python version of 2.7/3.4+ or downgrade to Glances 2.6.2 (last version
 with Python 2.6 support).
 
+*Deprecation warning note for Python 2.x users*
+
+Glances version 4.0 will no longer supports Python 2.x.
+
 Optional dependencies:
 
 - ``bernhard`` (for the Riemann export module)
 - ``bottle`` (for Web server mode)
 - ``cassandra-driver`` (for the Cassandra export module)
diff --git a/glances/compat.py b/glances/compat.py
index a0d14d89..86d72860 100644
--- a/glances/compat.py
+++ b/glances/compat.py
@@ -42,10 +42,14 @@ if PY3:
     from xmlrpc.server import SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
     from urllib.request import urlopen
     from urllib.error import HTTPError, URLError
     from urllib.parse import urlparse
 
+    # Correct issue #1025 by monkey path the xmlrpc lib
+    from defusedxml.xmlrpc import monkey_patch
+    monkey_patch()
+
     input = input
     range = range
     map = map
 
     text_type = str
@@ -130,10 +134,14 @@ else:
     from SimpleXMLRPCServer import SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
     from xmlrpclib import Fault, ProtocolError, ServerProxy, Transport, Server
     from urllib2 import urlopen, HTTPError, URLError
     from urlparse import urlparse
 
+    # Correct issue #1025 by monkey path the xmlrpc lib
+    from defusedxml.xmlrpc import monkey_patch
+    monkey_patch()
+
     input = raw_input
     range = xrange
     ConfigParser.read_file = ConfigParser.readfp
 
     text_type = unicode
diff --git a/optional-requirements.txt b/optional-requirements.txt
index dab6ba49..69a91a45 100644
--- a/optional-requirements.txt
+++ b/optional-requirements.txt
@@ -8,11 +8,11 @@ chevron
 couchdb
 docker>=2.0.0
 elasticsearch
 graphitesender
 hddtemp
-influxdb
+influxdb>=1.0.0
 influxdb-client; python_version >= "3.6"
 kafka-python
 netifaces
 py3nvml; python_version >= "3.0"
 paho-mqtt
diff --git a/requirements.txt b/requirements.txt
index 71439c7c..db8f5c38 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,3 @@
 psutil>=5.3.0
+defusedxml
 future
diff --git a/setup.py b/setup.py
index 98fcf6d9..0e80732a 100755
--- a/setup.py
+++ b/setup.py
@@ -39,11 +39,11 @@ def get_data_files():
 
     return data_files
 
 
 def get_install_requires():
-    requires = ['psutil>=5.3.0', 'future']
+    requires = ['psutil>=5.3.0', 'defusedxml', 'future']
     if sys.platform.startswith('win'):
         requires.append('bottle')
         requires.append('requests')
 
     return requires
@@ -58,20 +58,23 @@ def get_install_extras_require():
         'export': ['bernhard', 'cassandra-driver', 'couchdb', 'elasticsearch',
                    'graphitesender', 'influxdb>=1.0.0', 'kafka-python', 'pika',
                    'paho-mqtt', 'potsdb', 'prometheus_client', 'pyzmq',
                    'statsd'],
         'folders': ['scandir'],  # python_version<"3.5"
-        'gpu': ['py3nvml'],
         'graph': ['pygal'],
         'ip': ['netifaces'],
         'raid': ['pymdstat'],
         'smart': ['pySMART.smartx'],
         'snmp': ['pysnmp'],
         'sparklines': ['sparklines'],
         'web': ['bottle', 'requests'],
         'wifi': ['wifi']
     }
+    if PY3:
+        extras_require['export'].append('influxdb-client')
+        extras_require['gpu'] = ['py3nvml']
+
     # Add automatically the 'all' target
     extras_require.update({'all': [i[0] for i in extras_require.values()]})
 
     return extras_require
 

Vulnerable code: influxdb
    requires = ['psutil>=5.3.0', 'future']
        'gpu': ['py3nvml'],
Fixed code: - ``defusedxml`` (in order to monkey path xmlrpc)
- ``future`` (for Python 2 support)
*Deprecation warning note for Python 2.x users*

Glances version 4.0 will no longer supports Python 2.x.

    # Correct issue #1025 by monkey path the xmlrpc lib
    from defusedxml.xmlrpc import monkey_patch
    monkey_patch()

    # Correct issue #1025 by monkey path the xmlrpc lib
    from defusedxml.xmlrpc import monkey_patch
    monkey_patch()

influxdb>=1.0.0
defusedxml
    requires = ['psutil>=5.3.0', 'defusedxml', 'future']
    if PY3:
        extras_require['export'].append('influxdb-client')
        extras_require['gpu'] = ['py3nvml']