REDHAT-BUG-2393073: High severity langchain-ai langchain vulnerability
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2393073?
The severity of REDHAT-BUG-2393073 is classified as high due to the potential for XML External Entity attacks.
How do I fix REDHAT-BUG-2393073?
To fix REDHAT-BUG-2393073, ensure you upgrade to a secure version of langchain that disables external entity references in XML parsing.
Which version of langchain is affected by REDHAT-BUG-2393073?
The affected version of langchain in REDHAT-BUG-2393073 is 0.3.63.
What type of attack does REDHAT-BUG-2393073 expose the system to?
REDHAT-BUG-2393073 exposes the system to XML External Entity (XXE) attacks.
What component is vulnerable in REDHAT-BUG-2393073?
The vulnerable component in REDHAT-BUG-2393073 is the EverNoteLoader within the langchain project.