{"action":"Upgrade libtaxii to 1.1.118 or later.","affected":[{"fixed":"1.1.118","introduced":"0"}],"component":"libtaxii","cve_ids":["CVE-2020-27197"],"ecosystem":"PyPI","epss":0.02308,"exploited":false,"fixed_versions":["1.1.118"],"ghsa_id":"GHSA-836c-xg97-8p4h","id":"tcs_01M5KGARNZZXPWZ9C0G3QRB11A","modified_at":"2023-11-08T04:03:21.072622Z","published_at":"2020-10-17T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-59","https://github.com/TAXIIProject/libtaxii/issues/246","https://github.com/eclecticiq/OpenTAXII/issues/176","http://packetstormsecurity.com/files/159662/Libtaxii-1.1.117-OpenTaxi-0.2.0-Server-Side-Request-Forgery.html","https://github.com/advisories/GHSA-836c-xg97-8p4h"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-59","url":"https://osv.dev/vulnerability/PYSEC-2020-59"}],"summary":"** DISPUTED ** TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_netw"}