{"action":"Upgrade lxml to 4.9.1 or later.","affected":[{"fixed":"4.9.1","introduced":"0"}],"component":"lxml","cve_ids":["CVE-2022-2309"],"ecosystem":"PyPI","epss":0.02448,"exploited":false,"fixed_versions":["4.9.1"],"ghsa_id":"GHSA-wrxv-2j5q-m38w","id":"tcs_01M5KGGNKC9W7DKWHVJ2XQSZ3W","modified_at":"2023-11-08T04:08:16.338038Z","published_at":"2022-07-05T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-230","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://github.com/advisories/GHSA-wrxv-2j5q-m38w"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-230","url":"https://osv.dev/vulnerability/PYSEC-2022-230"}],"summary":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlie"}