CVE-2021-23418

Name of the Vulnerable Software and Affected Versions glances versions prior to 3.2.1

Description The issue is related to the incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to gain access to confidential data, disrupt its integrity, and cause a denial of service. The vulnerability is due to the use of Fault to parse untrusted XML data, making it susceptible to XML External Entity (XXE) Injection attacks.

Recommendations For glances versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Fault component to parse untrusted XML data until a patch is available. Avoid using the Fault function to parse untrusted XML data in the affected API endpoints until the issue is resolved.