CVE-2021-23418 (Other, published 2021-07-29T18:15Z)
Description: value: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/nicolargo/glances
Files changed:
Makefile
NEWS.rst
Commit message: Add NEWS file and improve Makefile


Vulnerable code:
	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s (by %an)"
Glances Version 3
Version 3.1.8
    * Remove bad merge for a non tested feature(see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
    * Version tag for docker image packaging #1754 
    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692 
    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689 

Fixed code:
	git --no-pager log $(LASTTAG)..HEAD --first-parent --pretty=format:"* %s"
	echo ""
	git --no-pager shortlog -s -n $(LASTTAG)..HEAD
                                Glances changelog
Version 3.2.0
This release is a major version (but minor number because the API did not change). It focus on
*CPU consumption*. I use `Flame profiling https://github.com/nicolargo/glances/wiki/Glances-FlameGraph`_
and code optimization to reduce CPU consumption from 20% to 50% depending on your system.

Enhancement and development requests:

    * Improve CPU consumption
        - Make the refresh rate configurable per plugin #1870
        - Add caching for processing username and cmdline
        - Correct and improve refresh time method
        - Set refresh rate for global CPU percent
        - Set the dafault refresh rate of system stats to 60 seconds
        - Default refresh time for sensors is refresh rate * 2
        - Improve history perf
        - Change main curses loop
        - Improve Docker client connection
        - Update Flame profiling
    * Get system sensors temperatures thresholds #1864
    * Filter data exported from Docker plugin
    * Make the Docker API connection timeout configurable
    * Add --issue to Github issue template
    * Add release-note in the Makefile
    * Add some comments in cpu_percent
    * Add some comments to the processlist.py
    * Set minimal version for PSUtil to 5.3.0
    * Add comment to default glances.conf file
    * Improve code quality #820
    * Update WebUI for security vuln

Bugs corrected:

    * Quit from help should return to main screen, not exit #1874
    * AttributeError: 'NoneType' object has no attribute 'current' #1875
    * Merge pull request #1873 from metayan/fix-history-add
    * Correct filter
    * Correct Flake8 issue in plugins
    * Pressing Q to get rid of irq not working #1792

Contibutors for this version:

    * Nicolargo
    * Markus Pöschl
    * Clifford W. Hansen
    * Blake
    * Yan

    * Remove bad merge for a non tested feature (see https://github.com/nicolargo/glances/issues/1787#issuecomment-774682954)
    * Version tag for docker image packaging #1754
    * Unusual characters in cmdline cause lines to disappear and corrupt the display #1692
    * class AmpsList method _build_amps_list() Windows fail (glances/amps_list.py) bug #1689