CVE-2021-23418: Improper Restriction of XML External Entity Reference (CWE-611)
value: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2021-07-29T18:15Z
Repository: https://github.com/nicolargo/glances
Language: Other
Files changed: Makefile, NEWS.rst
Commit date: 2021-06-12 19:15:31 +0200
Commit message: Add NEWS file and improve Makefile

Diff: diff --git a/Makefile b/Makefile
index 3de8aba3..0a6b594b 100644
--- a/Makefile
+++ b/Makefile
@@ -56,8 +56,10 @@ run-client: venv
 
 profiling: venv venv-dev
 	@echo "Please complete and run: sudo ./venv/bin/py-spy record -o ./docs/_static/glances-flame.svg -d 60 -s --pid <GLANCES PID>"
 
 release-note:
-	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s (by %an)"
+	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s"
+	echo ""
+	git --no-pager shortlog -s -n $(LASTTAG)..HEAD
 
 .PHONY: test docs docs-server
diff --git a/NEWS.rst b/NEWS.rst
index 8cc59634..c02ef556 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -1,17 +1,63 @@
 ==============================================================================
-Glances Version 3
+                                Glances changelog
 ==============================================================================
 
 ===============
-Version 3.1.8
+Version 3.2.0
 ===============
 
 Under Development.
 
 See roadmap here ==> https://github.com/nicolargo/glances/milestone/49
 
+This release is a major version (but minor number because the API did not change). It focus on
+*CPU consumption*. I use `Flame profiling https://github.com/nicolargo/glances/wiki/Glances-FlameGraph`_
+and code optimization to reduce CPU consumption from 20% to 50% depending on your system.
+
+Enhancement and development requests:
+
+    * Improve CPU consumption
+        - Make the refresh rate configurable per plugin #1870
+        - Add caching for processing username and cmdline
+        - Correct and improve refresh time method
+        - Set refresh rate for global CPU percent
+        - Set the dafault refresh rate of system stats to 60 seconds
+        - Default refresh time for sensors is refresh rate * 2
+        - Improve history perf
+        - Change main curses loop
+        - Improve Docker client connection
+        - Update Flame profiling
+    * Get system sensors temperatures thresholds #1864
+    * Filter data exported from Docker plugin
+    * Make the Docker API connection timeout configurable
+    * Add --issue to Github issue template
+    * Add release-note in the Makefile
+    * Add some comments in cpu_percent
+    * Add some comments to the processlist.py
+    * Set minimal version for PSUtil to 5.3.0
+    * Add comment to default glances.conf file
+    * Improve code quality #820
+    * Update WebUI for security vuln
+
+Bugs corrected:
+
+    * Quit from help should return to main screen, not exit #1874
+    * AttributeError: 'NoneType' object has no attribute 'current' #1875
+    * Merge pull request #1873 from metayan/fix-history-add
+    * Correct filter
+    * Correct Flake8 issue in plugins
+    * Pressing Q to get rid of irq not working #1792
+
+Contibutors for this version:
+
+    * Nicolargo
+    * Markus Pöschl
+    * Clifford W. Hansen
+    * Blake
+    * Yan
+
 ===============
 Version 3.1.7
 ===============
 
 Enhancements and bug corrected:
@@ -43,11 +89,11 @@ Contributors for this version:
 Version 3.1.6.2
 ===============
 
 Bugs corrected:
 
-    * Remove bad merge for a non tested feature(see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
+    * Remove bad merge for a non tested feature (see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
 
 Version 3.1.6.1
 ===============
 
 Bugs corrected:
@@ -72,12 +118,12 @@ Enhancements and new features:
     * Add attributes to stdout/stdout-csv plugins #1733
     * Do not shorten container names #1723
 
 Bugs corrected:
 
-    * Version tag for docker image packaging #1754 
-    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692 
+    * Version tag for docker image packaging #1754
+    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692
     * UnicodeDecodeError on any command with a utf8 character in its name #1676
     * Docker image is not up to date install #1662
     * Add option to set the strftime format #1785
     * fix: docker dev build contains all optional requirements #1779
     * GPU information is incomplete via web #1697
@@ -115,11 +161,11 @@ Enhancements and new features:
     * Value for free disk space is counterintuative on ext file systems enhancement #644
 
 Bugs corrected:
 
     * Can't start server: unexpected keyword argument 'address' bug enhancement #1693
-    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689 
+    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689
     * Fix grammar in sensors documentation #1681
     * Reflect "used percent" user disk space for [fs] alert #1680
     * Bug: [fs] plugin needs to reflect user disk space usage needs test #1658
     * Fixed formatting on FS example #1673
     * Missing temperature documentation #1664

Vulnerable code: 	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s (by %an)"
Glances Version 3
Version 3.1.8
    * Remove bad merge for a non tested feature(see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
    * Version tag for docker image packaging #1754 
    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692 
    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689 
Fixed code: 	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s"
	echo ""
	git --no-pager shortlog -s -n $(LASTTAG)..HEAD
                                Glances changelog
Version 3.2.0
This release is a major version (but minor number because the API did not change). It focus on
*CPU consumption*. I use `Flame profiling https://github.com/nicolargo/glances/wiki/Glances-FlameGraph`_
and code optimization to reduce CPU consumption from 20% to 50% depending on your system.

Enhancement and development requests:

    * Improve CPU consumption
        - Make the refresh rate configurable per plugin #1870
        - Add caching for processing username and cmdline
        - Correct and improve refresh time method
        - Set refresh rate for global CPU percent
        - Set the dafault refresh rate of system stats to 60 seconds
        - Default refresh time for sensors is refresh rate * 2
        - Improve history perf
        - Change main curses loop
        - Improve Docker client connection
        - Update Flame profiling
    * Get system sensors temperatures thresholds #1864
    * Filter data exported from Docker plugin
    * Make the Docker API connection timeout configurable
    * Add --issue to Github issue template
    * Add release-note in the Makefile
    * Add some comments in cpu_percent
    * Add some comments to the processlist.py
    * Set minimal version for PSUtil to 5.3.0
    * Add comment to default glances.conf file
    * Improve code quality #820
    * Update WebUI for security vuln

Bugs corrected:

    * Quit from help should return to main screen, not exit #1874
    * AttributeError: 'NoneType' object has no attribute 'current' #1875
    * Merge pull request #1873 from metayan/fix-history-add
    * Correct filter
    * Correct Flake8 issue in plugins
    * Pressing Q to get rid of irq not working #1792

Contibutors for this version:

    * Nicolargo
    * Markus Pöschl
    * Clifford W. Hansen
    * Blake
    * Yan

    * Remove bad merge for a non tested feature (see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
    * Version tag for docker image packaging #1754
    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692
    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689