PyPI/lxml CVE-2022-2309: unknown, EPSS 2.45%
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlie
Action: Upgrade lxml to 4.9.1 or later.
pip install lxml==4.9.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.9.1 | - |
Fixed versions
| 4.9.1 |
Sources
- osv: PYSEC-2022-230
- https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba
- https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f
- https://github.com/advisories/GHSA-wrxv-2j5q-m38w
CVE-2022-2309 · published · modified · JSON